It is likely that internal user data within Facebook (and other websites) is not encrypted, and can be freely snooped between the backend servers and the frontend servers.