RE:

Here's a question, and it's not rhetorical:
If you tell someone to go out and commit murder(s) and they do it, are YOU guilty -- or is just the person who actually committed the crime(s) guilty? In this scenario you don't witness the murder or pay for it, you merely _tell_ the prospective murderer to kill someone and then they act on their own. Maybe the target of the murder isn't even specifically named or known by either of you.

Programmers are constantly being asked by end users for various new reports and modifications. We programmers trust that the users know what they are doing, and they trust that we are able to deliver. Could be we are being asked to do something that is in violation of government regulations, ethics, accounting standards, etc. Without Change Control on modifications, there may be no good chain of evidence for the Programmer who it was who asked to have something done. Ignorance abounds.

This is not rhetorical. We see it all the time with computer security breach news.

An Inconvenient Lack of Truth ... public policy problems in perspective,
http://www.darkreading.com/document.asp?doc_id=150276&WT.svl=column2_1

A lawyer's perspective on PCI standard and TJX case
http://infoseccompliance.blogspot.com/2008/02/legal-implications-risks-and-problems.html
-
Al Mac