Students and lecturer in FreeHour hacking case get presidential pardons

Three students and a lecturer charged with hacking student app FreeHour have been granted presidential pardons. 

The four were investigated and hauled to court after they reported the security vulnerabilities to the company. 

In a statement on Tuesday, Prime Minister Robert Abela said cabinet is recommending pardons for all of them. 

Times of Malta had exclusively revealed the case back in 2023.

Students Michael Debono, Giorgio Grigolo, and Luke Bjorn Scerri were arraigned in March and accused of gaining unauthorised access to the application. Grigolo was also charged with making a change to the app, although he then reversed the application to its previous state.

Lecturer Mark Joseph Vella was charged with being an accomplice to these crimes, as he proofread an email the students sent to FreeHour, informing them of the vulnerabilities they found in their app.

 They pleaded not guilty. 

In a statement, the Office of the Prime Minister said the pardon was granted on the recommendation of the prime minister and the Cabinet since their actions were well-intentioned.   

The OPM pointed out how Prime Minister Robert Abela had already publicly argued that this matter should not have been addressed only from the legal aspect but also on the basis of what was just and fair, with the state assuming its responsibilities in circumstances where legislation needed to be updated to reflect technological development.  

The criminal proceedings against the four men are now being extinguished.

Back in October 2022, the students were scanning Freehour's app backend when they found vulnerabilities in it.

Grigolo made a change in the app, to prove to FreeHour that they found a breach in their system. They took a screenshot of what they changed and then, shortly afterwards, reverted everything back to how it was.

They sent an email to the founder of FreeHour Zach Ciappara with their findings and asked for a reward – known as a ‘bug bounty’ – for spotting the mistake.

It is common practice for companies to reward ethical hackers when they inform them of a breach in their system.

 Ciappara informed the police about the email that he received, which sparked an investigation.

In November 2022, Scerri, Grigolo and Debono were arrested in their homes, taken into custody and strip-searched.

The police also searched their homes and seized various pieces of equipment from the residences.

A fourth student, Luke Collins, who was also arrested at the time, was not charged.

Ciappara had said he was “legally bound to file a report of the potential data breach and did so within the legal deadline”.

Times of Malta last year reported that three students had been banned from competing in a European cybersecurity challenge as a result of their legal troubles.

The government should have changed the law immediately - PN 

The government should have changed the law immediately instead of allowing the three students and their lecturer to be taken to court over hacking, the Nationalist Party said in a reaction to the pardon.

"While welcoming the decision to grant a Presidential pardon, the Partit Nazzjonalista insists that these individuals should never have faced criminal charges in the first place – but Robert Abela wanted to play the hero so he could now boast about pardoning them," the party said.

It insisted that the law should be amended to prevent such a case from happening again.

"Instead of letting them face criminal charges in court and only now issuing a Presidential pardon, Robert Abela should have changed the law from the outset, so that these three students and the lecturer would never have had to face prosecution at all," it said.