> How did OP even remotely rationalize his decision? That's not hard for me to understand, because they basically explained it in their SO post. They thought t

> How did OP even remotely rationalize his decision? That's not hard for me to understand, because they basically explained it in their SO post. They thought that since they clearly explained to their director that the statement "we ran a pen test" was false, in writing, that they essentially "transferred" any liability to their director. To clarify, that line of thinking is wrong, but I can understand where it came from. That's why ethical training for software engineers is important, so that it's unambiguous that people were at least taught where the clear line exists, and if they go over that line it's because they chose to, not because they didn't understand where the line was.