My faith in humanity goes up when I see an unattended self-service stand where customers are trusted to pay for what they take. It works because the system is open to public view, and any passer-by (or even just a poster of a pair of eyes) can spot the cheater. (Then again, it takes only a tiny percentage of cheaters to ruin it for everyone.)

I remember reading a story on self-checkout devices which said that product theft actually went down after the devices were installed. Apparently the customers were more trustworthy than the employees when it came to retail theft. People will rise to the occasion and be trustworthy because you expect them to be. (I'm told that schoolteachers have known this trick for years: If you make it clear to students that you expect more from them, they will generally rise to the challenge.)

Fortunately, in my experience at Microsoft, I've seen more metrics + common sense than the pure metrics approach. For example, during the approach to a project milestone, management was watching the bug count very closely, but also understood that the raw numbers were just an approximation of the situation. After all, some bugs are easier to fix than others. A developer's bug count might not go down for a few days because he's working on a complicated bug. Another developer may have a relatively high bug count, but they're all simple bugs that can be taken care of relatively easily. Neither developer was told to "get those numbers under control" (and therefore were not tempted to manipulate the metrics). Indeed, management often chooses to redistribute some of the bugs (when possible) so that the workload is evened out.

Mark (The other Mark)'s middle ground is also employed. During a bug bash a few years ago, management set the ground rules for the event. There were some prizes to be awarded, but they also reminded participants that the goal of the event was to find useful, relevant bugs. They also reminded participants that the bugs filed should have value: Instead of reporting ten variations on the same underlying bug, file one bug that covers all the variations. It turns out that the bug bash indeed had a low incidence of "garbage bugs" that were filed for the purpose of gaming the metrics.

All they had to do was ask.