Three students and a lecturer have been charged with hacking Malta’s largest student app FreeHour, more than two years after they reported security vulnerabilities to the company.
Students Michael Debono, 22, Giorgio Grigolo, 21 and Luke Bjorn Scerri, 23, face charges of gaining unauthorised access to the application.
Grigolo is also charged with making a change to the app, although he then reversed the application to its previous state.
Lecturer Mark Joseph Vella, 45, is charged with being an accomplice to these crimes, as he proofread an email the students sent to FreeHour, informing them of the vulnerabilities they found in their app.
All four pleaded not guilty to charges.
As it happened
Back in October 2022, the students were scanning Freehour's app backend when they found vulnerabilities in it.
Grigolo made a change in the app, to prove to FreeHour that they found a breach in their system. They took a screenshot of what they changed and then, shortly afterwards, reverted everything back to how it was.
They sent an email to the founder of FreeHour Zach Ciappara with their findings and asked for a reward – known as a ‘bug bounty’ – for spotting the mistake.
It is common practice for companies to reward ethical hackers when they inform them of a breach in their system.
After receiving the email, Ciappara informed the police about the email that he received, which sparked an investigation.
In November 2022, Scerri, Grigolo and Debono were arrested in their homes, taken into custody and strip-searched.
The police also searched their homes and seized various pieces of equipment from the residences.
A fourth student, Luke Collins, who was also arrested at the time, has not been charged.
Ciappara had said he was “legally bound to file a report of the potential data breach and did so within the legal deadline”.
Times of Malta last year reported that three students had been banned from competing in a European cybersecurity challenge as a result of their legal troubles.
Magistrate Marse-Ann Farrugia presided over the case.
Inspectors Markus Cachia and Warren Muscat, alongside Attorney General lawyers Mauro Abela and Daniel Vancell prosecuted.
Defence lawyers Joe Giglio, Michaela Giglio, and Roberto Montaldo represented the students.
Defence lawyers Michael Sciriha and Lucio Sciriha represented the lecturer.