Drop the charges instead of pardoning the 'hackers', academics say on FreeHour saga

Recommending a pardon for the lecturer and students charged with hacking the FreeHour app fails to address the legally complex processes that resulted in the charges, the University of Malta Academic Staff Association (UMASA) said on Thursday.

In a statement, UMASA said resolving the matter through a presidential pardon is not a satisfactory or appropriate solution.

“The pardon is a short-term patch with wider implications suggesting the worrying criminalisation of lecturers in the area. The long-running core issue is that there remains a lack of national policies ensuring safety for those conducting cybersecurity teaching, learning and research,” the statement said.

UMASA acknowledged the publishing of a National Coordinated Vulnerability Disclosure Policy as a step in the right direction, but said more attention is needed on ongoing and systemic problems.

They described the pardon as a deus ex machina approach, and the charges “an isolated incident that can be summarily dispelled and washed away by the exceptional use of a discretionary power, without addressing the legally complex processes”.

“The most appropriate solution would have been to drop the charges and to review the procedures which put lecturers and learners at risk.”

Three students – Michael Debono, Giorgio Grigolo and Luke Bjorn Scerri – were charged last week with gaining unauthorised access to the FreeHour app.

Their lecturer, Mark Joseph Vella, was charged as an accomplice because he proofread an email sent to FreeHour by the students.

Back in October 2022, the students scanned the app’s software and discovered vulnerabilities in it. Giorgio Grigolo made a change to the app to inform FreeHour of this vulnerability, took a screenshot of the change, and reverted everything back to its original state shortly after.

After this, the students emailed FreeHour’s founder, Zach Ciappara, outlining their findings and asked for a reward in return for finding this mistake. However, Ciappara reported the email to the police.

Scerri, Grigolo, and Debono were arrested at their homes in November of 2022 arrested and taken into custody. Police strip-searched them, searched their homes, and seized various tech devices and equipment.

However, the cabinet discussed the charges during a meeting on 11 March, and agreed to recommend to the president that they be pardoned.