# 2022 FreeHour Ethical Hacking

The 2022 FreeHour ethical hacking case refers to a legal and cybersecurity controversy in Malta involving three University of Malta computer science students – Michael Debono, Giorgio Grigolo, and Luke Bjorn Scerri – and their lecturer, Mark Joseph Vella. The group identified critical security vulnerabilities in FreeHour, Malta’s most popular student timetable management application, and reported them to the company through ethical hacking practices. Instead of receiving recognition or a standard "bug bounty" reward, the students faced criminal charges under Malta’s Computer Misuse Act, sparking national debates about cybersecurity laws, academic freedom, and ethical hacking protections.

## Background
### Freehour

Developed by entrepreneur Zach Ciappara, FreeHour became Malta’s dominant student app by 2022, with features for class scheduling, social event organization, and university resource sharing. Its rapid adoption by over 90% of Maltese tertiary students made it a critical piece of educational infrastructure. However, the app’s technical architecture had not undergone independent security auditing prior to the incident.

### Ethical hacking context

Ethical hacking, or "white hat" security research, involves proactively identifying system vulnerabilities to prevent malicious exploitation. International tech companies like Google and Microsoft operate formal bug bounty programs, offering financial rewards and legal protections to researchers who follow responsible disclosure protocols. Malta lacked specific safe harbor laws for ethical hackers in 2022, leaving researchers vulnerable to prosecution under broad computer crime statutes.

### Discovery of vulnerabilities

In October 2022, during a routine cybersecurity exercise, the students identified multiple critical flaws in FreeHour's API architecture. Forensic analysis revealed:
* Unauthenticated Endpoints: Certain administrative API routes lacked proper authentication checks, allowing any user to execute privileged operations.
* Data Exposure: User records including phone numbers, email addresses, and class schedules could be retrieved through parameter manipulation.
* Injection Vulnerabilities: Missing input sanitization enabled potential SQL and command injection attacks.
To validate their findings, Grigolo temporarily modified a non-essential app feature, immediately reverting it after capturing proof-of-concept evidence. The group documented their methodology and prepared a disclosure report following ISO/IEC 29147 guidelines for vulnerability handling.

## Legal proceedings
### Arrests and charges

On November 3, 2022, armed police conducted simultaneous raids on the students’ residences:
* All electronic devices (laptops, phones, IoT devices) were seized
* Subjects underwent strip searches at police headquarters
* Initial 48-hour detention without access to legal counsel

### Disclosure and initial response

On October 15, 2022, the students emailed FreeHour's founder detailing the vulnerabilities, accompanied by:
* Technical documentation of the flaws
* Step-by-step reproduction guides
* Recommended mitigation strategies
* A request for a bug bounty payment commensurate with industry standards
Lecturer Mark Vella proofread the disclosure email but did not participate in the technical research. FreeHour's legal team responded by filing a criminal complaint with the Malta Police Cybercrime Unit on October 18, invoking Article 337 of Malta’s Criminal Code regarding unauthorized computer access.
Charges filed in February 2024 included:
| Defendant | Charges | Maximum Penalty |
| M. Debono | Computer misuse (Art. 337(1)), Obstruction of computer system (Art. 337(3)) | 4 years imprisonment |
| G. Grigolo | Unauthorized data modification (Art. 337(2)), Unlawful data copying (Art. 337(4)) | 6 years imprisonment |
| L.B. Scerri | Computer misuse (Art. 337(1)), Conspiracy to commit cybercrime (Art. 335D) | 4 years imprisonment |
| M.J. Vella | Accomplice liability (Art. 121(2)), Extortion via electronic communications (Art. 87A(2)) | 7 years imprisonment |
The prosecution alleged the vulnerability disclosure constituted an attempt to "extort payments through threats of public exposure"

### Court proceedings

First heard in March 2025 before Magistrate Marse-Ann Farrugia, the case featured:
* Prosecution Team: Inspectors Markus Cachia and Warren Muscat with AG lawyers Mauro Abela and Daniel Vancell
* Defense Counsel: Joe Giglio/Michaela Giglio (students), Michael Sciriha/Lucio Sciriha (Vella)
* Key Arguments:
** Defense emphasized compliance with RFC 9116 vulnerability disclosure standards
** Prosecution focused on technical unauthorized access under literal law interpretation.
All defendants pleaded not guilty, with ongoing proceedings suspended following the cabinet’s pardon recommendation on March 11, 2025.