Three computer science students who won a national cybersecurity competition have been told they cannot continue to the international stage of the contest because of a police investigation.
Michael Debono, Giorgio Grigolo, and Luke Bjorn Scerri participated in the National Cyber Security Challenge, a competition organised by the Malta Information Technology Agency (MITA) in May, and placed first, second and third.
All three won vouchers, and Debono, who placed first, automatically qualified for the European Cybersecurity Challenge (ECSC) in Turin, Italy.
The other two were meant to join a local boot camp where the top 10 participants would also be selected to join the Maltese delegation for the European competition.
Yet, their celebrations were short-lived when MITA recently called them in for a meeting to inform them they were suspended from the competition until police investigations were concluded.
The investigation dates to October 2022, when Debono, Grigolo, Scerri and another student were arrested after they found and exposed a security weakness in Malta’s largest student application, FreeHour.
No charges have been filed against the trio.
The students had e-mailed FreeHour to inform the company of the security flaw and requested a reward – or ‘bug bounty’ – a common practice in ethical or ‘white hat’ hacking. But instead of a payoff, the University of Malta students were arrested, strip-searched and had their computer equipment seized.
At the time they told Times of Malta they were only trying to help the app improve its security, and FreeHour, which initially filed the police report, said it was “exploring ways to help” the students.
It’s a wish of mine to see a flourishing community of cybersecurity enthusiasts in Malta. However, I’ve begun to lose hope- Michael Debono
In the competition, in May, the trio were rewarded for their skills in solving cybersecurity challenges linked to web and mobile security, crypto puzzles, and forensics.
MITA said it decided with “great responsibility” to suspend the three winners until the police investigation is concluded.
Debono said he was “devastated” when he found out he would not be representing Malta in Turin, especially since he was looking forward to meeting other international computer science students.
“It’s a wish of mine to see a flourishing community of cybersecurity enthusiasts in Malta. However, I’ve begun to lose hope,” the 21-year-old told Times of Malta. “I’m seriously considering opportunities abroad as it feels suffocating to do what I love in Malta.”
Despite no charges being filed, the investigation remains open and their equipment is still in the hands of the police, which has distressed the students.
“We have not heard anything back from the police about investigations, and there is no open case against me or any of my friends,” he said. “I don’t think we did anything wrong, so why am I being excluded?”
He added that the ongoing investigations could potentially prevent them from participating in future competitions due to the age limit for ECSC being 25.
Grigolo, participating for the second time in the national competition, voiced his frustration, particularly for Debono.
“It’s not fair, especially for my friend Michael,” he said. “He was guaranteed a spot, while for Luke and me, the authorities could argue that they are not going to shortlist us during the boot camp as they would be ‘abiding’ by the regulations of the qualifying process. This still does not make sense, as we are the top three.”
He said the idea of having a court case hang over their shoulders has impacted them mentally.
“I was slightly in disbelief and very disappointed in them, although I thought I should have seen it coming,” Bjorn Scerri said, adding that the trio should have been informed before the competition began. “There isn’t even an open case against me or my friends. I thought the principle of ‘innocent until proven guilty’ would apply here,” the 23-year-old continued.
MITA to reconsider suspension once investigation is complete
Replying to questions, an MITA spokesperson said the agency will reconsider the suspension once the investigation is complete.
“Our ethical values, which we embrace every day, were upheld in the case of the three winners. A meeting between the agency and the individuals involved was held first.”
She explained a decision on whether MITA will send a Maltese delegation to the international event would be taken at a later stage and would make a final decision after the local boot camp.
Police did not respond to questions about the investigation.