Client-side detection. You can probably argue that it can be evaded easily because it is client-side, but most people won't bother + it isn't like FB has an open API with a ton of third party FB clients.

I spent less than a minute thinking about this, but there are probably tons of other strategies they can employ. People familiar with the domain, I would actually love to hear your takes on this, as the topic is fairly fascinating.

It's an interesting idea. Assuming it's feasible, I wonder whether people would actually want to use a messaging service that's private, except where it thinks it detects illegal activity, in which case messages are copied to the police (and end-to-end encrypted on the way there, of course). That seems practically and logically equivalent to a messaging service which is not end-to-end encrypted but run by a trusted operator.