The article mentions the NSA, but if you don't think this can be used by anyone (not just people with huge botnets or databases like the NSA) then you'd be wrong as well. Consider trying to find the address of a person that you only know the facebook account of, but their name isn't listed in the phonebook. If you can see their friends list then it's fairly likely that it might have familiy members or housemates on it who _are_ listed. This is just one way of using the friends list. So it's a huge privacy issue that someone's friends list is exposed because anyone can use that information to figure out things about the person.