Is it possible that this program is ineffectual, because of publicly-available information from other sources that can be cross-referenced?

If I were to put together a badly implemented privacy program that people can trivially circumvent without breaking the law, who should be blamed when people do exactly that?

Me, or the people doing the trivial yet legal circumvention?