1. This assumes his description of his actions is completely accurate<p>2. This assumes that he was perfectly accurate in his assessment of an unfamiliar project&#x27;s naming conventions, data structure, etc.<p>3. This assumes that he was perfectly reliable in making the actual copies and didn&#x27;t accidentally include potential personal data (e.g. who knows what might be in a log file?)<p>The problem is that we&#x27;re talking about someone who already decided to exceed the bounds of what was clearly protected under the bounty program. He&#x27;d already reported the initial vulnerability and been paid for it but waited until later to mention that he&#x27;d copied a bunch of other data, had access to critical infrastructure, and wanted more money.<p>It seems fairly likely that this wasn&#x27;t malicious but rather just poor judgement, but that makes it very hard to assume that outside of that one huge lapse in judgement he did everything correctly. It&#x27;s really easy to see why Facebook couldn&#x27;t trust his word at that point since it&#x27;s already far outside normal ethical behaviour.