Facebook&#x27;s disclosure policy reads:<p>&gt;If you give us reasonable time to respond to your report before making any information public, and make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service during your research, <i>we will not bring any lawsuit against you</i> or ask law enforcement to investigate you.<p>IANAL: but it could be argued (in court) that he had Facebook&#x27;s permission to getting the AWS keys. In his opinion (and mine) he made good faith efforts to avoid privacy violations.<p>Facebook&#x27;s official disclosure policy has legal weight. There is legal concept (whose name is escaping me) that could apply that in laymen&#x27;s terms say the official disclosure policy gives him Facebook&#x27;s tacit approval - I first heard about it in the Oracle v Google where Google argued a <i>blog post</i> congratulating Google provided tacit approval.