An engineer working as a computer programmer played a minor role in developing a computer system for a state department of health. The system stored medical information on individuals identified by name. Through no fault of the engineer, few controls had been placed on the system to limit easy access to it by unauthorized people. Upon learning of this, the engineer first informed his supervisor and then higher management, all of whom refused to do anything about the situation because of the anticipated expense required to correct it. In violation of the rules for using the system, the programmer very easily obtained a copy of his own medical records. He then sent them to a state legislator as evidence for his claims that the right of citizens to confidentiality regarding such information was threatened by the system. Was his behaviour improper? Was his subsequent firing justified?