If even a single byte leaked, I guess the charges can include being accessory to identity fraud?

Criminal charges assume intent, and it's very hard to think that facebook as a company had intent of committing identity fraud.

Crimes do not always require intent. It depends on what the statute says specifically.

Yes, there're such crimes, but there aren't so many of them.

There are lots of crimes that require a mental state less than intent (either recklessness or criminal negligence, mostly, though there are some strict liability crimes, and the weird case of “malice aforethought” for common law murder which is narrower than recklessness but just slightly broader than only intent.)

Recklessness and negligence require some understanding of what you are doing and that it's wrong. So, it's really hard to commit them by mistake.

> Recklessness and negligence require some understanding of what you are doing and that it's wrong.

Negligence specifically does not, it only requires the existence of a duty of care (except not in specialized cases, that of reasonable care, which doesn't mean you are aware of risk, but that a reasonable person in your place would be.) Recklessness requires conscious awareness and disregard of risk, but not awareness of wrongness.

Harms from recklessness are mistakes, while recklessness itself is not, but negligence is quite normally a mistake.

You know data often leaks and leads to identity theft and yet you slurp it down anyways and freely share it around. Sounds reckless and negligent to me.

Since it appears the investigation is focused on information sharing agreements between Facebook and "device manufacturers" I would suspect criminal wiretapping.

But of course there's always the Computer Fraud and Abuse Act which is so broad that it could potentially apply to just about anything anyone has ever done via an internet connection.