First, yes, there are several countermeasures that can be implemented. That is no indication of the fact that they are implemented. There are some relatively ea

First, yes, there are several countermeasures that can be implemented. That is no indication of the fact that they are implemented. There are some relatively easy countermeasures you can put in place to avoid any security incident, and yet hardly a day goes by without reading about one in the news. There are companies that (supposedly) implement various such countermeasures, and have a very strong incentive to do so, as they handle private, and potentially damning data of important people with millions of dollars to lose in case of a data breach. Just look at Panama Papers, Paradise Papers and the like. If that sort of data can be treated carelessly, I find it somewhat unrealistic to expect better treatment (even from Facebook) of private data belonging to terrified teenagers who effectively have no recourse against misuse of their pictures. Second, it took considerable time for the fact that former NSA employees used the agency's surveillance tools to spy on their ex-lovers, too. The fact that we haven't yet seen any stories of employees abusing backend access to the Facebook servers does not tell us much. In fact, given how much information is publicly shared (sometimes unwittingly) via a Facebook account, it may be hard to tell when such an event occurs.