RE:

[Al Mac Wheel <macwheel99@xxxxxxxxxx>]

Here's a question, and it's not rhetorical:
        If you tell someone to go out and commit murder(s) and they do it, 
are YOU guilty -- or is just the person who actually committed the crime(s) 
guilty?  In this scenario you don't witness the murder or pay for it, you 
merely _tell_ the prospective murderer to kill someone and then they act on 
their own.  Maybe the target of the murder isn't even specifically named or 
known by either of you.

Programmers are constantly being asked by end users for various new reports 
and modifications.  We programmers trust that the users know what they are 
doing, and they trust that we are able to deliver.  Could be we are being 
asked to do something that is in violation of government regulations, 
ethics, accounting standards, etc.  Without Change Control on 
modifications, there may be no good chain of evidence for the Programmer 
who it was who asked to have something done.  Ignorance abounds.

This is not  rhetorical.  We see it all the time with computer security 
breach news.

An Inconvenient Lack of Truth ... public policy problems in perspective,
http://www.darkreading.com/document.asp?doc_id=150276&WT.svl=column2_1

A lawyer's perspective on PCI standard and TJX case
http://infoseccompliance.blogspot.com/2008/02/legal-implications-risks-and-problems.html
-
Al Mac