Sometimes surveillance tools are really interesting to build though.

I made a tool that injects into the winlogon session and keylogs it, so you can steal passwords before the user ever logs in.

For one reason or another I'm deeply motivated by a little malice in ways that I'm just not most of the time. Maybe I'm just a bad person.

The point is to at least think about consequences and whether those consequences are ok to you, and say no if they cross your lines. It is one thing to convince you to be totally ethical, but quite another to convince you to say no to jobs you find unethical because you fail to think through the consequences or ask the right questions, or because you don't dare say no.

Here's an example I ran into a while back:

My boss at the time came to me and asked me to "resurrect" an old database for a former client. In itself this wasn't so odd - said client had been "leaving" for over a year and kept asking us to keep data around so we could spin things back up, and paid handsomely for it.

But I asked what they needed it for anyway.

And then it turned out my boss wasn't asking for it for the old client, but for our new corporate overlords, who he wanted to hand their customer data to in order to pass to their sales team. Said sales would not compete with the old client, but still, 1) this was their data that we only kept around due to a request to keep it for a while longer as a contingency, 2) EU data protection regulations don't allow handing of personally identifiable inforation to a third party without consent.

So I told him no. He argued that it was our data because we hosted it, and I told him it doesn't work like that and that it would almost certainly be both a contract breach and a breach of privacy laws we were bound by. He let it go.

The point is in this case it was way over the line for me personally, and over line legally, but I only found out because I ask about motivations if people ask me to do something unusual. Sometimes that isn't enough to prevent unethical stuff either, but it's a very simple habit and the above is just one of many things I've refused because I asked what it was for before handing over data.

For someone else the ethical lines would perhaps be different, but it's at least worth taking measures to ensure nobody makes you take part in something like this without it being a conscious choice.