[einhverfr]

It would be covered under the Stored Communications Act. Unfortunately reading the act it looks like it is up for debate as to whether they are breaking the law. The Stored Communications Act allows voluntary disclosure when two things are true:

1) The communications were inadvertently obtained and 2) The communication appears to pertain to commission of a crime.

I don't think you can classify this as inadvertent. So I wonder if Facebook can be sued.

There is one way to find out. Create a decoy post, hear from law enforcement, and sue Facebook.