All of the parent poster's thoughts are valid, and I agree.
A few additional thoughts, though:
- Bring the ToS violation issue up with the objection "due to potential legal risk to the company, this should be run past the legal department." Cc: the legal department on that memo. That will come off as concern for the company and not a refusal to do the work. If your boss is angry, you can always claim "I'm looking out for both our jobs", and legal will likely agree. Not only that, it will CYA against being personally named if someone does sue, because you were acting on legal counsel.
- Hardcopies of e-mail aren't enough. Bcc: yourself on all communication so all is properly threaded. Take snapshots of your mail folder daily, and digitally sign and encrypt them before moving them offsite. Cryptographically sign all of your outgoing messages. If possible, request your boss do the same.
- If your boss inists on doing something you feel might be illegal (or at least likely to get you or the company sued), make an appointment with your legal department. They are required, in most places, to keep your identity sealed. Your boss is also unlikely to mess with them. :)
- If the concern is ethical, make an appointment with your boss' direct manager. Explain that you don't want to get your boss in trouble, but explain that you "have a difference of opinion" over the ethics and ask his/her help in resolving it. Get the resolution in writing. Not only does that CYA to another level, if done tactfully it will be noted positively.
Some of these actions are a small risk to your job if you have a vengeful boss. However, most of them allow for recourse of "wrongful termination", since you have a clear paper-trail showing that you were not refusing but raising ethical and legal concerns. Depending on where you live, you might be further protected by "whistle-blower" legislation.
IANA Attorney, so please check with one if you're interested in what your precise rights under the law may be.