You will not collect users' content or information, or otherwise access Facebook, using automated means (such as harvesting bots, robots, spiders, or scrapers) without our permission.
So Facebook can give permission, and clearly have given permission via some interfaces.
If Power could have done everything they wanted to do via the official developer APIs, no doubt the case would be different.
Power continued even after Facebook asked them to stop (and further tried to block Power's IPs) -- so at least some of the access occurred when permission, if any, was clearly not given.
But is that a crime? Or a contractual violation or tort?
The idea is that there is "unauthorized access" to Facebook's computers, that is, the user accessed Facebook's systems in some way that Facebook didn't like. Facebook wants absolute jurisdiction over who and what can see information stored on their servers and they want the civil justice system to enforce this will on their behalf after-the-fact.
Under Facebook's claims, people could get arrested for something as small as using a browser or operating system that Facebook didn't like. If this idea is accepted, then Facebook can pretty much say anything and if you violate that thing and then access Facebook, Facebook would seek criminal penalties for your violation. For instance, if Facebook says "no person that doesn't own a pair of Nikes can access Facebook, under our new Nike sponsorship deal", and someone who doesn't own Nikes still accesses Facebook, Facebook would consider this "unauthorized access" and get mad. Or, if Facebook decides it doesn't like born in Florida, and they write "No one born in Florida may access Facebook", and you still access Facebook after being born in Florida, Facebook will try to get the police to come and arrest you.
Open Graph API is not unauthorized access because Facebook allows people to use it.
Under Facebook's claims, people could get arrested for something as small as using a browser or operating system that Facebook didn't like.
Under Facebook's terms, you could retrieve some Facebook pages from your cache, write a parser to parse your data and use it to harvest your data to a CSV file, and even this would be a violation.
