People would go through users telephone logs, listen to their voicemails and read their SMS messages. If you had the right access, it was a wide open system with little or no safeguards on it. I think back on it now and am appalled, but at the time it was a kind of running joke to the guys in tech support.

My contract agency requested that I provide them with a company directory. I found the least helpful way to comply with that I could, with minimal information. Though thinking back on this, I 1) probably shouldn't even have done that, 2) should have refused the request, and 3) should have reported the request to the client.

And that's one of the, generally, more upstanding contract shops I've dealt with (still have occasional relations though no further gigs to date).

Dealing with ethics in the heat of it, especially where an engineering mindset tends to "this is a problem I should figure out how to solve" can be ... interesting.