Some years ago I was working contract for a large employer. Among other systems I had access to was the LDAP database (effectively: the full company directory).

My contract agency requested that I provide them with a company directory. I found the least helpful way to comply with that I could, with minimal information. Though thinking back on this, I 1) probably shouldn't even have done that, 2) should have refused the request, and 3) should have reported the request to the client.

And that's one of the, generally, more upstanding contract shops I've dealt with (still have occasional relations though no further gigs to date).

Dealing with ethics in the heat of it, especially where an engineering mindset tends to "this is a problem I should figure out how to solve" can be ... interesting.

Ethics obviously don't apply when a friend asks nicely...

I suppose the problem is that there is no canonical standard of ethics to which we can point. We should write one.