Shouldn't the office releasing the SSNs (the police department) to a member of the general public (programmers in question) be held accountable for releasing sensitive information, not the person that bought it?