...insulting to the community of responsible security researchers
At first glance at the article, it seemed that Facebook may have reneged on its offer of protection, but based on your explanation, it now seems that the hacker was indeed malicious, and only used the "white hat defense" as a shield.
I'm a huge advocate of ethical and responsible disclosure, so kudos to you for encouraging it where appropriate.
You think you can sue someone for sharing vulnerability information?
If you're curious, the EFF has published a number of great articles on the topic:
https://www.eff.org/issues/coders/vulnerability-reporting-fa...
https://www.eff.org/deeplinks/2010/12/knowledge-power-facebo...
Not only is it legal to disclose unfixed vulnerabilities, but it is legal to sell them. Presently, the biggest buyer of them is none other than the US government.
People obviously do it, all the time, against sites that haven't officially given permission (as Google and Facebook have), and most of the time they get away with it, but they are rolling the legal dice every time they do. People have been getting in trouble for doing this for years.
The people selling vulnerabilities are generally running the software themselves. Huge difference.
Are you the law?
Should you make your own rules?
Should you have your own court?
Because that's how you are operating.
You made your own law and tempted people to break "common law". Double standards.
How much data did he access?
If you're wondering whether it affected the privacy of data created by people who use Facebook, the referenced article has a statement that it was not, but it appears this was added after the article was published, so you may have missed it.
If you're wondering whether it might be a small amount that a security researcher might collect to verify their report, from what I understand it was more than that.
"If you give us a reasonable time to respond to your report before making any information public and make a good faith effort to avoid privacy violations, destruction of data and interruption or degradation of our service during your research, we will not bring any lawsuit against you or ask law enforcement to investigate you."
His attempt to access data was outside our whitehat guidelines, had clear malicious intent, and included extensive and destructive efforts to remain undiscovered and anonymous. In addition, he made no effort to contact Facebook with his discoveries, and even denied involvement when initially questioned. His attempt to claim he intended responsible disclosure only after faced with criminal action is false and insulting to the community of responsible security researchers.