KSU offering to cover legal expenses for students arrested after exposing FreeHour security flaw

Kunsill Studenti Universitarji (KSU) has offered to cover any legal expenses incurred by four students who were arrested and had their laptops confiscated after exposing a security flaw in FreeHour’s backend system.

In a statement, KSU said that it has approached the students and is willing to help cover any legal expenses that they may incur due to court proceedings.

"KSU is concerned to see the efforts of four students result in their arrest. It is equally frustrating to see a set of outdated laws be misapplied in such a situation, coupled with the overly swift action taken by the Police," it said.

FreeHour is a popular student app that allows Sixth Form and University Students to share their timetables and find common free hours.

But the company landed in hot water on Wednesday after the Times of Malta reported that four students were arrested and interrogated by police after exposing a flaw in the app’s backend system.

The flaw meant anyone could access a student’s personal data, including their email and personal calendar.

The students had reached out to FreeHour explaining the security flaw and asking for a reward, or ‘bug bounty’, for exposing the risk.

FreeHour released a patch shortly after noticing the flaw and filed a report with the Information and Data Protection Commissioner.

This report resulted in a subsequent police report, after which police arrested, interrogated and confiscated the laptops of the four students who exposed the flaw.

FreeHour insisted on Wednesday that it never pressed charges against the students and did not intend on getting the students arrested.

CEO Zach Ciappara said that that they only filed a report with the Commissioner to make sure they were legally covered in terms of the potential data breach.