Government moves to amend cyber laws to allow ethical hacking

The Maltese Government is considering amending the country’s cyber laws to allow ethical hacking, following controversy surrounding the prosecution of three university students and a lecturer accused of hacking the FreeHour student application. The move aims to prevent similar cases from leading to criminal proceedings in the future.

Students Michael Debono, 22, Giorgio Grigolo, 21, and Luke Bjorn Scerri, 23, are currently facing charges of gaining unauthorised access to FreeHour. Mr Grigolo is also accused of making a modification to the app before reverting it to its original state. Their lecturer, Mark Joseph Vella, 45, has also been charged as an accomplice, having proofread an email the students sent to FreeHour detailing the vulnerabilities they discovered.

The case has sparked widespread debate, with many arguing that the students and their lecturer acted in good faith by identifying and reporting security flaws. On Thursday, both the Nationalist Party (PN) and new political party Momentum called for the charges to be dropped and urged a reform of Malta’s cybersecurity laws to protect ethical hackers.

The PN insisted that the accused individuals were merely fulfilling their responsibility by highlighting weaknesses in the FreeHour platform. This perspective has gained traction, with stakeholders from the tech and legal communities emphasising the need for a clear distinction between malicious hacking and responsible vulnerability disclosure.

Prime Minister Robert Abela confirmed to Times of Malta that the Government is reviewing the current legal framework, with plans to introduce amendments that reflect modern cybersecurity realities.

“Any changes to the current legal framework will arguably apply to any person facing pending charges. However, since the legislative process takes time and there is widespread agreement that the students and lecturer should not have their judicial process drag any further, the Cabinet will discuss this case and decide on whether to exercise its prerogative to extinguish these proceedings,” Dr Abela stated.

The proposed legal revisions come after public consultation on the matter, with the Government now in the final stages of drafting the necessary amendments. If approved, these changes would ensure that ethical hackers acting in good faith would not face prosecution, aligning Malta’s legal stance with international best practices on cybersecurity.

The case has highlighted the pressing need for Malta’s cyber laws to be updated in response to evolving digital security challenges. The Government’s commitment to reform is expected to provide much-needed clarity and legal protection for individuals engaged in ethical hacking.