I’ve been consistently amazed by human behaviours for many years, and through many employers.
One of the behaviours that always astonishes me is when I let someone know that they’re violating security policy, or simply behaving in an insecure manner, and rather than changing their behaviour or defending their own actions per se, they respond with some variation of “sure, but such-and-such team/person is already doing that and far worse”.
Maybe it’s my grammar school upbringing, in which it was clear that the response of “but Sir, Jenkins minor was also chewing gum” was not only going to get Jenkins into trouble, but also get me into more trouble (if only when Jenkins found out who snitched) – I really can’t see that there’s any appropriate response to such statements other than to say “well, thank you for drawing my attention to that other infraction, which I will decide to address at my convenience – now, back to your case…” – or perhaps less usefully, “that may be, but it’s you that I caught.”
I readily acknowledge that institutional behaviours are as much learned from the actions of one’s peers, so that it is important to curb widespread culturally-ingrained wrongness.
But I don’t see what people who use this argument expect will happen – is there really a circumstance in their past in which someone said “really? Oh, well then, that’s alright. Carry on.”