<story><title>I Hacked into Facebook&apos;s Legal Department Admin Panel</title><url>https://alaa.blog/2020/12/how-i-hacked-facebook-part-one/</url></story><parent_chain><item><author>trav4225</author><text>I&amp;#x27;ve always wondered, aren&amp;#x27;t these types of bug investigations illegal? Aren&amp;#x27;t the investigators concerned about criminal prosecution? Not being snarky; I&amp;#x27;m asking sincerely.</text></item></parent_chain><comment><author>jcims</author><text>In general you are on shaky legal ground.&lt;p&gt;However, some companies (including Facebook) have a bug bounty program that provides a prescribed safe harbor that you can operate within to discover vulnerabilities within their products or infrastructure in exchange for some kind of recognition or award.&lt;p&gt;The terms of Facebooks bounty are here: &lt;a href=&quot;https:&amp;#x2F;&amp;#x2F;www.facebook.com&amp;#x2F;whitehat&quot; rel=&quot;nofollow&quot;&gt;https:&amp;#x2F;&amp;#x2F;www.facebook.com&amp;#x2F;whitehat&lt;/a&gt;&lt;p&gt;Based on a cursory glance and the fact that this individual was awarded in their program, it appears they operated by the book.&lt;p&gt;Prosecuting activity that happens outside of these parameters has definitely happened in the past and will continue.  It&amp;#x27;s not always a cut and dried decision.  It can be difficult&amp;#x2F;expensive to effectively prosecute and you may find a lot of social backlash depending on the nature and impact of the activity.</text></comment>
<story><title>I Hacked into Facebook&apos;s Legal Department Admin Panel</title><url>https://alaa.blog/2020/12/how-i-hacked-facebook-part-one/</url></story><parent_chain><item><author>trav4225</author><text>I&amp;#x27;ve always wondered, aren&amp;#x27;t these types of bug investigations illegal? Aren&amp;#x27;t the investigators concerned about criminal prosecution? Not being snarky; I&amp;#x27;m asking sincerely.</text></item></parent_chain><comment><author>detaro</author><text>Places with a bug bounty program typically publicly state rules for what they think is ok for a researcher to do, specifically to avoid that problem. Without permission like that, yes, such an investigation can quickly move into legally dangerous areas, and not all companies have gotten the idea that if someone is willing to tell you about a problem you want them on your side, threatening or suing them just means the next time someone finds something you&amp;#x27;re not told. (of course that&amp;#x27;s not a free-for-all for researchers, if you start actually poking in private data or hack actual peoples accounts that&amp;#x27;s a problem)</text></comment>