I agree, dubious use of the term white-hat. He hacked into their systems, stole the code, and kept a copy on an external hard drive. Didn't do anything malicious, but didn't contact Facebook about it either. They discovered the intrusion by accident, and it took them months to track him down.
So "keeping the data to himself and doing nothing with it" is considered white hat?
So "keeping the data to himself and doing nothing with it" is considered white hat?