PN MP Ivan Bartolo Proposes Legal Safeguards For ‘White Hat’ Or Ethical Hackers
PN MP Ivan Bartolo has raised concerns about the legal implications of cybersecurity and ethical hacking following the recent FreeHour controversy.
In a LinkedIn post, Bartolo warned that the recent arrest of four students for reporting a security vulnerability is a matter of great concern for the cybersecurity industry.
“Ethical hackers (also known as white-hat security researchers) play a crucial role in the cybersecurity ecosystem. In contrast with bad actors and criminals who exploit vulnerabilities for malicious purposes, ethical hackers use their knowledge and skills to identify vulnerabilities in computer systems and networks with the sole goal of improving security,” Bartolo said.
“If currently our laws are not flexible enough to make this distinction, we need to act now and introduce a ‘safe harbour’ framework which would provide protection from legal action when a researcher identifies a vulnerability and reports it in good faith to the responsible organisation.”
“Security researchers have always feared that they could face legal repercussions just for being ‘good samaritans’. They now know it is a concrete reality.”
Warning that this case will do nothing to help Malta retain the talents of IT professionals, Bartolo said it is imperative to create a system that encourages and develops a talented pool of cybersecurity professionals who can effectively protect digital assets.
The four computer science students – Giorgio Grigolo, Michael Debono, Luke Bjorn Scerri and Luke Collins – were arrested last November after informing the student platform FreeHour that they had found a security flaw in its backend which, if exploited, could have compromised the private data of student data. They gave FreeHour a three-month deadline to secure a vulnerability and requested a “bug bounty” as a reward for identifying the flaw.
FreeHour CEO Zach Ciappara said that while their developers fixed the security flaw within 24 hours, the company also reported the email to the police after receiving advice that they were legally responsible to do so. The police strip-searched the youths and seized their electronic equipment but haven’t prosecuted them.
Ciappara said he hopes the youths aren’t charged, stating his belief that their actions weren’t malicious and thanking them for bringing the security flaw to FreeHour’s attention.
Do you agree that our laws need to become more flexible to accommodate technological advances?
READ NEXT: JeanPaul Sofia Photo And Candles Swept Away From Castille Doorstep Very Soon After Mother’s Protest
