&gt; The Facebook Whitehat TOS explicitly forbid getting sensitive data that is not your own using an exploit.<p>This seems to be the crux of this whole thing. The article suggests that is not true, including some quotes from what I assume is &quot;The Facebook Whitehat TOS&quot; at [0] along with his interpretation of those quotes. As an unsophisticated person reading through that document, I don&#x27;t see anything I would describe as &quot;explicitly forbidding getting sensitive data that is not your own using an exploit&quot;. The closest seems to be: &quot;make a good faith effort to avoid privacy violations&quot;. I&#x27;m inclined to believe you and others in this thread that this was not the most responsibly done, but the seeming repeated claim that there is an explicit policy against this, which doesn&#x27;t seem to be findable makes me scratch my head. Is there some other document, that is more explicit, or is this just supposed to be implicit knowledge, or what?<p>[0]: <a href="https:&#x2F;&#x2F;www.facebook.com&#x2F;whitehat" rel="nofollow">https:&#x2F;&#x2F;www.facebook.com&#x2F;whitehat</a>