University academics back lecturer and students accused of hacking

Updated 6:10pm

The union representing University of Malta academics has expressed its support for a lecturer and his three students due to appear in court this month, charged with hacking Malta’s largest student app FreeHour.

In 2022, the students were among a group of four to inform the app’s developers of a vulnerability in the software while requesting a reward, or ‘bug bounty’ - a common practice in ethical hacking, or ‘white hat’ hacking.

Students Michael Debono, Giorgio Grigolo and Luke Bjorn Scerri stand accused of gaining unauthorised access to the app, while lecturer Mark Joseph Vella is being charged as an accomplice for proofreading the email the students sent to FreeHour.

In a statement, the University of Malta Academic Staff Association (UMASA) expressed its “solidarity” with the group and said it believed Vella, a senior Computer Science lecturer, “acted with academic integrity when teaching his students ethical practices in testing cybersecurity.”

The statement follows a similar announcement by the association in September, when it said Vella had “fulfilled his duties and responsibilities as a lecturer” while noting the vulnerability had been fixed before the flaw in the app was made public in line with international guidelines.

The students and their lecturer will appear before Magistrate Marse-Ann Farrugia later this month.

A fourth student, Luke Collins, who was originally arrested, has not been charged.

‘Abela should have changed the law’

Earlier on Friday, it emerged the government was considering stepping in to halt proceedings against the students in the controversial case.

In comments to Times of Malta, Robert Abela said the cabinet would discuss the case and decide "on whether to exercise its prerogative to extinguish these proceedings”, with it understood the prime minister was referring to the granting of a presidential pardon.

He said the government was also reviewing the current legal framework to bring about changes that would ensure no one in similar circumstances faces criminal proceedings in the future.

Responding to Abela’s comments, the Opposition Nationalist Party (PN) said Abela “should have changed the law so the three students and their lecturer... would not have had to face charges in the first place.”

The PN said the government could still change the law, a course of action the party said it had been “urging for several months.”

"Despite this, in an attempt to appear as a hero, Robert Abela is now willing to put these individuals through an ordeal after they were charged with criminal offences in court, only to later boast about granting them amnesty.”

The Opposition urged the government to “immediately” present the necessary legal amendments and said it was prepared for a special session of Parliament to convene to bring through the changes.

“It is not yet too late for the Government to do the right thing”, the PN said.

'Deep concern'

In a statement on Friday evening, union group Forum Unions Maltin (For.U.M.) expressed its "deep concern" at the criminal proceedings and said it welcomed the PM's comments on possible government intervention. 

The organisation also noted with concern that Malta was not among the leading countries for cybersecurity readiness, noting this left "Maltese organisations, businesses, and society more vulnerable to cyber threats."

It called for specialised cybersecurity university degrees to better protect Malta's digital infrastructure. 

"Efforts to combat cyber threats must be applauded, and the state should not criminalise individuals who are merely trying to develop vital skills in cybersecurity," the organisation said.

"Instead, Malta should focus on fostering a skilled workforce capable of protecting our digital infrastructure and mitigating future risks."

A new policy?

In September, Abela told ONE Radio that cabinet was discussing a policy document drafted by the Malta Digital and Innovation Authority (MDIA) aimed at protecting ethical hackers.

He said the policy document – which had been slated to be available for public consultation – would introduce safeguards for those who contribute to improving computer and data security systems, clearly distinguishing them from individuals involved in malicious activities.