Let&#x27;s take a step back here: Facebook threatened to have a security analyst arrested for demonstrating and promptly disclosing the full extent of a serious exploit in a non-destructive manner. Whatever other behavior he engaged in that was unnecessary or ineligible for the bug bounty program, that&#x27;s incredibly unethical on your part. Especially so, because you clearly didn&#x27;t believe he was going to do any damage to your system or you would&#x27;ve actually called the FBI instead of someone he worked with.<p>So, you just wanted to cause him reputational damage and personal problems as an act of petty retaliation. You&#x27;re right on some of the technical issues here, but in terms of ethics, your behavior has been far worse than his. I don&#x27;t think you realize how much long-term damage you&#x27;re doing to your relationship with the wider security community by threatening to jail people who were at no point acting maliciously and at no point caused any damage.