IT Employment

Ask something
Discussion Locked

CEO surfs porn

0 helpful
280 replies

by mllwyd 3 views

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I'm the IT manager of a mid-sized company. We have a policy about what employees are not allowed to view on the web, and we have a web filtering appliance in place to keep people from going to inappropriate web sites.

The problem is that the CEO thinks it is fun to try to "beat" the web filtering software. He spends his free time trying to go to porn sites. Sometimes he gets through, at which point he downloads images and movies and viruses.

My staff has caught him in the act of accessing porn sites, has had to deal with the viruses that he gets from surfing porn sites, etc. My boss, the CIO, has spoken to the CEO about this a couple of times, explaining to him the real dangers to the company of his behavior. He always promises to stop, but never does.

Does anyone have any suggestions on how to handle this situation?

280 replies

by too old for it

The CEO should be fired for violating company IT policy. With the job market the way it is, it should be no problem to replace him/her with someone who can do the CEO function.

by tomsal

Morally/ethically I'm right with you on that sentiment of firing the CEO...but now let's be honest with ourselves, based on our professional experiences....you and I both know unless the company is public the CEO is as close to untouchable as you can get.

So unfortunately in most private businesses unless for some strange reason their is a position above CEO (Chairman/Owner perhaps?) the CEO is the top dog and as such right or wrong will get away with practically anything short of breaking the law (and even sometimes then too).

by techrepublic

In most cases CEO is owner/part owner or a large stock holder. getting rid of the Pres. of the USA would be easier. Possibly sit down in a meeting and discuss with him/her that maybe they should have an "off the network" Laptop for thier "issues"

by o/siris

How big is this company? I mean, if the CEO is the owner and it's privately held, then there may not be much you *can* do. Not "to" the CEO, anyway.

In fact, I'd argue that "what to do" about the CEO himself is not your job, since you mention a CIO. That's for the CIO to do. What I'd recommend you do is document it. Logs, screen caps if you can, instances of virus infection, so forth. Give the CIO the evidence he or she needs to make the case for putting this to a halt.

BTW, is the CEO all that tech savvy? If he's able to get around your blocking, then maybe you should be working on that.

by youraveragemanager

"However, the basic formula for determining what constitutes a hostile work environment is conduct that is so severe or pervasive, as viewed by the victim and a reasonable person, that it unreasonably interferes with an employee's work performance."

See http://www.szd.com/news/pub_info.php?PID=79
for a far better than average description.

The Hostile determination is not in the CIO's or the CEO's hands, that determination is made by the victim(s), and only one other reasonable person.

So maybe the size of the organization does matter. Thinking back to 19 employees and above qualifies the employer for the hostile classifications, in the USA.

It has been my experience that at the executive level (for larger organizations) this could be the start of a self destructive cycle where increasing dysfunction will be displayed until action must be taken by the organization in order to minimize the financial losses.

So, CIO's it is not under your control, and never was. Appearently HR is not communicating clearly or consistently to all levels of the organization. I suggest that they double their efforts in order to limit the exposure now. They could even demand that the surf reports are sent directly to HR for their action.

After all Tech Support personnel viewing and taking offense is also a likely violation.

by lebalang

You do not need to attempt to fire the CEO, instead you have to be carefl because the CEO is just about to fire you. The fact that the CEO managed to bypass your restrictions means you are not doing your job.
So instead of wasting time figuring out how to confront the CEO use the time to figure out how to tighten the access restriction rules!

From Lebalang.

by tomber

Why not just block his general web access with ACL's. Just add in the sites that he really needs to access. It might be long and harduous but it will do the job.

by debon

Some firewalls have a blacklist for domains to which access must not be granted and this usually allow settings such as BLOCK ALL DOMAIN NAMES THAT CONTAIN THE WORD "porn" or "fetish" etc (am sure you get the picture) and even IP addresses. Years ago in a previous job, over time we accumulated a list of over 100 such words and while our CEO was not involved there were executives and staff members who surfed porn, lottery, music and even horoscope sites.

My advice is NOT to challenge your CEO, your CIO did a dangerous thing but just let it go at that. Believe me, you cannot win this one. Someone suggested that you publish the logs - I DO NOT THINK YOU SHOULD DO THAT !!!!!!!. Block the sites as best you can, review the logs daily and include sites that he has been successful in accessing. This is a kind of cat and mouse game but its the best you can do.

Am sure he will say he is just testing how effective your firewall set up has been in detecting and preventing access to porn sites and while I do not doubt your sincerity, the fact is you have no conclusive evidence that he is not doing just what he says.

About the viruses, can't you set up his machine that it automatically scans all downloaded materials?

by dwdino

Since the CEO is a known threat to the integrity of the company, reverse the filter and/or firewall settings on him to be deny all, allow a few.

First all, assign a statice IP if he doesn't already have one. Set the switch to only allow that IP and MAC on the given port (layer 3).

So for instance if the CEO was 10.10.5.1, then the rules be something like:

10.10.5.1:80 -> google.com:80 allow
10.10.5.1:80 -> wsj.com:80 allow
10.10.5.1:* -> any:* deny

By setting the above rules, the CEO will only be able to browse google and wall street journal, all other traffic will be denied. You can then have the CEO make requests to have other things allowed with justification.

This is the system we have for a few hard to manage, un-removeable (sp) persons in our network.

by husp1

sure beats the snot out of my idea, I would have placed him on a non network PC for about a month and let the virus, malware, and trojans just pile up. after the month or so when the system crashes and he begins to cry then maybe allow him MODERATE access to network. (on a seperate and blocked unit) some people need to get the kick in the pants for themselves before they listen.

by thelastword

Don't even tell him you did it. Just say it had to be done for a technical reason to clear up the viruses!!!! SMART!!!

by glyn_canada

Good tactic to control, same type of idea I'd have used. You are only dealing with half of the problem though.

It is up to you as the IT Manager to formally tell the CIO (once more) that the CEO is up to his old tricks and that it contravenes (sp) company policy. You then have covered your butt in a policy issue. You then let the CIO what you have done to contain the problem, how many man hours at what rate it has cost him out of his budget to cover the CEO's stupidity, also add in what pet projects of the CIO's that have been backshelved as a result of the action you have had to take.

At this point, once the CIO (who is usually a bean counter of some description) has realized that it is costing him money, you ask the CIO what the escalation process is in this situation. (You know it, you have read enough of the policies and procedures to find out this other info out already)

Chances are a) It is the CIO or HR Directors job to bring this up with the board or a disciplinary panel at this level of seniority. b) the CIO as a bean counter will be so annoyed that he is losing money, that it will become a vendetta for the CIO.

We had a similar problem with our ex-CEO. He set off our IDS every day, we packet filtered and kept pages of logfiles. He got sloppy on other areas of his job and this stuff was used as support info for his dismissal.

It prevented him getting off because it proved a general slack attitude (sorry to swear in front of other IT slackers - but when the boss does this it is a bad thing, not energy efficiency like in your case)instead of him whining about making a little mistake that was out of character, we had the proof that it was an ongoing issue.

One other tack that you might liked to have taken was disconnect the idiot from the network completely and see if your friends can find you a 300-600 baud modem for his machine. Even perv's get bored some time.

;o)

by tomsal

Where I am , CEO is top dog. No one can tell him what to do -- oh we can recommend and suggest, with factual data to back it up...but that part you put in your post "CEO make requests to have other things allowed with *justification*"..that wouldn't fly here not in 1,000 years.

It would be deemed "not being a team player", "disgruntled worker" , or "insubordination to an executive" and would likely lead to being fired.

by dwdino

I have been entrusted to secure, maintain, and streamline the network and data systems attached there to. I have authority over those systems to make necessary changes to promote all things beneficial to these objectives and remove all things detrimental. As such, one's behavior that causes such detrimental circumstances will be restrained or removed.

Now sir please tell me in writing that you do NOT want me to do the job for which I was hired; that you DO want me to allow things to transpire within our company that have been stated as NOT Allowed and Detrimental; and that you are above the "laws" that govern every other employee.

That was my basic argument. Also, when such statements are presented, always, Always, ALWAYS, have someone of C level and non C level there to witness it (CYA).

by fdohle

If you can , have security put a hidden video in his office, and catch him pulling one off while he's surfing those nasty sites possibly with his office door closed.

Then - show him the Video.

Enforcing policy should now be a cinch - and while your at it - negotiate yourself a big fat raise.

by oz_media

Your choice. But trying to call the CEo on something is going to get YOU fired no matter what you have on him, excluding selling secrets to your competitors.

he is not hired to follow little company policies regarding PC use, viruses etc.

You have a job because these other people are not expected to know better and are hired for other tasks. He gets paid a geat deal more than you for what he brings to the table, you get your salary to keep the OTHERS (your peers, whether sales, reception, HR etc.) from selling out the compant and costing them money, the boss will ignore a CEO costing him $10,000 LONG before he will ignore a resume being sent out by a $3,000/mo secretary via Monster.com.

you are not there to police the CEO, end of story.

This is NOT a moral issue, it is a REVENUE issue.

The boss looks at it in black and white, HOW MUCh REVENUE DOES IT GENERATE? $0.00 (you are there to save revenue and you are a company expense no matter how much you SAVE them).

the CEO can be reposnible for generating MILLIONS in revenue each year, employers see revenue, not morals. If YOU were surfing porn, you'd be gone in a heartbeat. A for a MAJOR revenue generator, they will replace you with someone who doesn't complain about the CEO's usage.

Seen it, warned the IT guy against it, went to the goodbye party for his last day.

The next admin just did what he was hired to do, clean up after the bosses and keep the peon staff in line.

Sorry but there's a reality to the cyberworld too. Top brass wil spend tens of thousands each year keeping these men/women happy, free golf, free travel, free private sports boxes etc. A few grand lost due to YOUR overtime is not going to get anyone fired, except the person who complains about the job he/she is hired to do.

REALITY CHECK!
get over it, or somone else will get into it.

by bmarr

Every company should have it's checks and balances. Although the CEO is the top dog, HR should be notified of this behavior if it hasn't stopped. HR has the power to document and even reprimand the CEO of a company regardless of how powerful they are. I've seen it happen.

I would also keep logs, emails, anything you can think of in regards to this just in case the heat comes down on you for some reason. In the end, you need to have the ability to protect yourself if need be.

by snasdeo

Once someone in an organization is confronted by the HR department for a violation of ANY company policy, the corporation now has a legal liability to correct it. If someone else in the company 'happens' to see the porn, they can file a complaint against the company with the EEOC of the state they live in. Now the company is in legal hot water because they knew about the issue and did nothing.

I would suggest that you, the top HR person, the company's legal council and the CEO have a meeting to discuss this and the financial implications that it could have on the company. Once you show the CEO the financial damage this could do, plus the damage it could do to the reputation of the company with their clients and the potential loss of business, the CEO will change his ways and seek help.

by protiusx

It is your job to report it to your superiors and the HR department and that is really all you can do unless he is accessing sites that are illegal such as kiddy porn sites. Then you should report the activity to the proper authorities.
As the CEO he should report to the board of directors and that is the body that would discipline him for this activity. Internet porn is a huge problem that affects millions of men and women around the world. It is a poisonous drug that can destroy a person. If he's doing it at work you can bet he's doing it at home too and the fact that he's doing it at work is an indicator of the level of the problem. He may need to seek some form of counseling for this. Bottom line I think is to let HR know and let them handle the situation.
Good Luck!

by despair

This is nice to listen to but is often far from the truth! I agree that you should maintain complete documentation for the purpose of covering your ass. But beyond that, and this includes fantasizing that corporate policies apply equally to everyone, forget it. You match up against the CEO and you will lose (meaning get fired with extreme prejudice)!

I'm from a third world country where CEOs are literally gods. The CEO of my company, who was a high government official projecting a squeeky clean and incorruptible public image, personally ordered me to acquire 5 brand new top-of-the-line PCs and a brand new HP laser printer and deliver these to a foundation where he is the executive director. He then gave instructions to prepare the necessary documents to make it look like the company donated the equipment to his foundation. He required the company technicians to visit the PCs regularly for troubleshooting. He even diverted software licenses from the company so he could install them in those machines.

I documented everything - kept every email and memo in hard copy. Then I showed them to HR. Two days later, I was summoned by the CEO who gave me what could be the worst day of my life. HR later gave me notice that I have to resign or I will be fired for insubordination.

I tried to bring the incident to the attention of the chairman of the board since nobody in the company would help. All I got was a cold shoulder.

Up to now, I still have anxiety attacks because of that experience. I now make out a living as a freelance PC technician. Life has been very hard since then. Finding another job has been very frustrating. This is what I got for standing up for what is right. This is what could also happen to you. Just ignore the pervert! Anyway he's the one who will look like a sleazeball.

by mllwyd

We discussed this issue with the company lawyer and because we are privately-held, the CEO can do whatever he wants.

by thelastword

there's no doubt. He's pushing some kind of wierd limit and surfing porn at the same time. It is very close to sexual harrassment if your staff has 'caught him' a few times. This is gross in the work place. I would freak. I would tell him that 1) the staff feel uncomfortable when seeing this and it taints the workplace and 2) He is promoting this behavior to others who could also see that surfing porn is just a way of 'breaking the system' that way they can 'get away with it'. I would tell him he is making alot of people uncomfortable and even have a survey or something signed by a whole pile of people or whatever to get the point across. Then go over his head somehow, is there anywhere to go?

by husp1

sad to say but most guy like pretty girls in little or nothing at all. But there is a time and place for everything and work isn't one of the best places for porn. Perhaps you should give this guy a designated "Nakid girly machine" whith appropriate labeling and location? (old pc in a closet with a superslow modem and a sign on the door that say's in use by perv.)

by tomsal

Your idea of the stating the effect on the company and why you are hired in the first place, even putting it in writing...great idea in theory, I really like it.

I'm just telling you if I did that here...I'd be sent packing the same day.

The CEO is the dictator. Bar None. Period.

He'd be humilated nonetheless, especially if I had witnesses...so I might not be fired on the spot...but I'd "mysteriously" be "let go" within a day or two. Guaranteed.

Heh..."Its good to be the king".

(wonder if I'll ever be able to say that about ME? LOL).

by italian

Major policy based internet security have a fixed set of addresses that are "non accessable".
Web Sweeper (from Baltimore) and Web Marchall has this facilities. Further, I you like to combat in this type of arena make sure that some financial losses are involved!
1) The server was down for 4 hours resulting in $$$ losses,
2) Install the new internal firewall on the CEO computer,
3) Upgrade the external firewall to the newest banned sites.
Usually CEO's respond very well to financial losses, I would be the first option!
I hope this has helped you!

by johan101

Ok
Maybe i'm going a bit overboard here

USE THIS IDEA ONLY WHEN ALL ELSE FAILS !!!!!!!

first make sure you unoticely have a full backup of all information including the CEO and other top management and workers.

Then put a redirect on his favorite porn site to a virus ( not networke capable preferably, unless your desperate ) and make sure he will have a few days downtime .
then tell your CIO and HR department that the CEO's PC was down for x days and that he could not work due to his ignorance of policy.

If this fails to cause the desired waves then redirect him to a network capable virus BUT MAKE SURE YOU KNOW HOW TO DISINFECT IT AND HAVE BACKUPS otherwise your without a job.

If that does not help then he must be the majority shareholder or something in wich case your atempts are useless.
just leave it.

!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!
have fun but be wise and make sure that all CRITICAL offices STAY ONLINE
!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

If your lucky you might be a hero and might get more respect for "seeing this problem come" and recovering everything while keeping critical offices up and running ( even if they might have slight downtime of 10 - 20 minutes maybe wich will further drive your point:-)

JUST REMEMBER TO BE RESPONSIBLE AND DONT GO OVERBOARD

PLEASE REMEMBER TO BLOCK EVERYBODY EXCEPT YOURSELF FROM TECHREPUBLIC IF YOU GO FOR THIS ROUTE OTHERWISE YOU MIGHT JUST BE CAUGHT OUT AND LAND IN COURT.

Johan
IT MANAGER

by jan.heystek

What has been said about this subject is fair and true.
If its a public company, you can have the CEO removed, but only with evidence.
You need to gather it and supply it to the CIO to act on, other than that it's out of your hands.
If it's a private company have everybody do the same and make it know that the Boss is Ok with it. or i.e. have every body waste time, soon he'll see his company's money going down the drain, he'll stop.

by michaelpo

If your midsize company is like the one I worked for, there is a higher level above this CEO. I ran into this situation a few years ago. When I was unable to resolve it, I took it to a higher level and now he works for a different company. You have to present it as a request for direction and outline what you have done. If it is perceived as an attempt to get him fired, I do not think the result would be the same.

by aformer cio

I really sympathize with you. I was in a situation that was similar. The CFO barely did his job, and was known by all to surf porn, try to pick up women in chat rooms, click on every email attachment, etc.

He was particularly good at boardroom BS, in a company where boardroom BS was really appreciated! I was there - he could make it sound like he was on top of everything, even though he was completely unprepared!

Everyone knew, and stayed away when the door was closed, and they could hear the keyboard rattling! For some reason, the mouse on that PC was turning black - an endless source of jokes when he was not around!

Such behaviour is tolerated, usually because they have friends, the owner or the CEO. If the CIO requests that you document, then you can discuss it. If you brought it up, and it was dropped, then you document only for your self, in case you get fired for the network being down all of the time, and need some proof to fight back with.

You need a way to document to prove that it really did happen, to show that you did not fabricate your documentation. This to to prevent the inevitable legal argument of "revenge of a disgruntled ex-employee" and you would probably want a lawyer friend involved!

You don't want to waste a lot of company time doing this, either or you could get fired for that, too....

Technology is the better answer, so if there is a new piece of software that your company acquires, and it appears to have the side effect of removing all of his fun, then you can get away with it. This is by far the safest route!

Forget that crap about going to the board, or HR. That will get you the boot quicker than you would ever believe possible! I was let go under similar circumstances, and it was "justified" simply with "you don't fit in".

Be careful, and with any luck, it will take care of itself!

by prendergasta

As a current CIO, I can tell you that going to the Board or HR would be asking for trouble. I think that this is the CIO's responsibility. I have a very good relationship to the boss. If one of my manager's informed me of this behavior, I would have this discussion about professionalism, costs, leadership, etc. However, if your boss can bypass your filters, then I submit that your filtering strategy needs to be revisited. If the CEO's computer is getting a virus then I would submit that your virus strategy needs to be revisited. Both solutions need to be redesigned! If all else fails, you may want to create a monthly report for the CEO on what everyone in the organization is doing as far as what sites are being visited and who the staff are ... you can sell it as providing feedback to the organization. He will undoubtably see himself on the list and the sites that he has visited. When other senior managers see the report, this will be a wake-up call for the CEO. Good luck!

by mllwyd

Because the CEO is the owner's son, it is extremely doubtful that he would be fired.

by apotheon

There's not really anything you can do. Do your job to the best of your ability, document everything, report your collected data when and where appropriate, and don't overstep the specific tasks associated with your job. Meanwhile, look for a job at a company that doesn't have this problem. If you manage to get a job somewhere else so that you won't have to deal with this any longer, you might (politely) arrange for the CIO, or even the owner if you have his ear at all, to find out why you're leaving.

The CEO is actively pursuing ends that contradict the necessities of your job description. Because he's the owner's son, all you can really do is document and carry on, and look for a better job in the meantime.

Don't do anything that could be considered sabotage of company resources. Don't go behind the CEO's back in any way that might come back to you. Don't confront him directly as though you have personal authority to order him around. The above could get you canned or, worse, in legal trouble. It's not worth it.

That's about all there is to it.

by richard j. sullivan - florida

YOu have two issues here and neither is good. You have a CEO who has a social / mental / medical problem in that they are addicted to PORN and therefor needs a lot of help to overcome this addiction. You also have a serious issue with virus, security,etc. which is not something that you can overlook.

First you need to address the CEO's access to these PORN sites. You can either totally isolate the CEO from the rest of the network, either through firewall access, direct connect to the internet, or by whatever means and therefore eleminate or reduce their affect on the rest of the network and let them surf porn to their hearts content, but not allow them access to any production servers, applications or other business related sites.

I am sure that this will not sit well with the CEO, but you have to protect your systems. Or, you can document and present to the Board of Directors / HR department and Legal, the fact that you have repeatedly brought this issue to the CEO and they continue to perform in direct violation to corporate policies (there are written policies against this type of behavior, right?).

If there are no policies or permitted use procedures - which also spell out the penalties for inappropriate use - approved by HR, Legal and BOD... you might as well sit back and enjoy te ride.... 'cause nobody is coming to your rescue.

by thefogking

With general HR policies being what they are today, and the litigious society in which we live, I think the company's attorney should go at it from the potential Liability stand-point.

Any time the "L" word is heard by a CEO, s/he normally reacts immediately. Although it sounds as though a sexual addiction may be the root cause...

by sparksh

If you are in a public company, the Sarbanes-Oxley rules require a method for employees to report suspected ethics violations. In most cases this can be done anonymously. Look for that possibility. If there is no ethics hotline, I suggest going to internal audit and the audit committee.

by bubbaonthenet

Whistle Blowing is a bad idea because only your Group knows about his/her browsing activity. Use common sense: the guy in Shipping doesn't know the CEO's browsing habits. All roads lead back to you.

You will have poked the CEO of your Company with a stick and humiliated him/her. How righteous and smart will you feel in the unemployment line?

Whistle blowing right off the bat shows you do not know how to communicate, provide an opportunity for feedback and positively promote and foster an open channel of communication between you and your Environment. The CEO is a human being capable of communication and reasoning just like the rest of us. ::I said capable, not promising anything more then that::

Address the issue one-on-one and privately --HR does not need to have their nose in the business. It is a private discussion between two Employees about the threat posed by Internet porn-surfing ::one just happens to be the CEO and the other the IT Manager::

If that is not clear enough think of this scenario: It is the annual shareholders meeting. The room is packed with 2000 Shareholders. Security checked your status as a Shareholder before you were able to sit down in your assigned seat (the more shares you hold the closer to the stage you sit.)

There are four public microphones from which a shareholder can address their question they submitted to the Q&A Committee to ask of the CEO and his board. It's your turn, and you say to the elected CEO: "Mr./Mrs. CEO, I am the Network Manager. I am removing your privilege to surf the internet as it poses a threat to our Network. Surfing Pornography is a threat to the integrity of my Network and it threatens this Company."

Think how creditable you will be then. I would venture to say they won?t call you a Martyr but more like a Jackass.

Remember, Executive Privilege is the only reason why you the IT Manager is not there his/her Boss discussing this.

Do not go for public humiliation ever. Give the guy/gal a chance to understand where you are coming from and meet halfway. You are being paid to be flexible and to negotiate for positive outcomes ::that's the "Manager" part of your title, otherwise you can always step down if it is asking too much of you:: [Mike Dupris]

by bubbaonthenet

Corporate Attorneys are the paid puppets owned and controlled by the Executives --that is the essence of their work. They are paid to clean up after the Boss.

Care to retract or do you really think there are Attorneys out there that could enforce their CEO's web browsing activity? Even a private attorney can do nothing more then advise their Client to the best of their ability then let them run their own course. [Mike Dupris]

by mllwyd

The lawyer said the CEO is within his rights to do what he wants. He's under no obligation to follow company policy, apparently.

by sandburr

Your goal is to protect your network. Slow his present workstation down however you can, slower connection or whatever, so it's not as fun to use to surf. Set up a second decent pc, make it cool,off the network for him to use for his fun pc. Cloak it the best you can with off the wall name unassociated with your company, etc. Image it and when it gets screwed up, reimage. This is your workstation and this is your pc, this one's for work and this one's for fun.

by whyurs

Just read up on SOX...he goes to jail! That should be the only wake up call needed! Oh, the CFO also goes to jail so if you have one you might also 'cc' them on this...

That or report them to the BOD(not the professional thing to do unless P&P state you need to, it dies fall within P&P and needs to be there if not currently).

reach me off line if you wish...

dbittlingmeier@yahoo.com
CTO, CISSP, PMP, MS

by graham.orr

If you're not bright enough to figure out how to get this dick-wad sacked you're not bright enough to seek advice. However, in the light of it being Ramadan and all that - Send a copy of what he downloads to each of the top 10 investors. Make sure they know he is responsible for his actions, then watch what happens.

by bree

The 10 investors look at the earnings report and balance sheet... see that the pornoholic CEO is a brilliant money-maker et voila... he keeps his job and gets a bonus to boot. The IT managers are replaced with managers who understand "the needs of the business" and who are willing to take reasonable "business risk" and it's a done deal.

That's reality.

by mlayton

...in my case it was the attorney. I am gathering its a small company and private, and all the advice to "get him sacked" or "go to the investors" just won't cut it, those that are in similar situations know in small companies there are no investors. So, I would recommend the technology route. Most of the web filters allow you to add sites, so I would go ahead and bounce it up as high as you can, and if worse comes to worse, restrict his IP altogether except for certain sites. Good luck.

by aaron a baker

As the person in charge of the inner workings of this system, you could someday be held accountable for how this CEO got by you.
There's only one real defense,"RECORDs KEEPING".
Write it all down when it happens. If and when the day comes that you are asked to exlain yourself, there will two things on your side, 1rst he's "Your Boss", 2nd "Your Notes and Logs,Time and Events".
If you really want to stop this guy, report to a higher up and I mean "Way Higher", so as not to arouse curiosity "with proof" and get then back to records keeping. Let the people above him know what's going on and let them decide his fate. Just make sure to protect yourself and your integrity.
You're the Chief Tech and you're on the line here and so is your reputation.
Don't fool around.
Good Luck
AaB

by oz_media

I had a boss who used to call us all in when he found good porn on Kazaa! He refused to have anything locked down and figured the network was for entertainment.

Luckily I was a sales rep then and not responible for the network.

In YOUR case, if he bypasses security and company policy, all you need is the logs to remove yourself from blame. If your boss has spoken with him, it should be documented or witnessed that it was brought up.

Sure you have to work to keep it safe but that's what you are hired for, idiots like this endanger networks...enter IT dept.

by arnold_aidan

What I can suggest, especially for people downloading movie/music files, is to say that BSA - Business Software Alliance - works together with a lot of ISPs and major software companies to sniff for people who download & view/use them illegally (which is a fact!). CEOs will have to bear the hefty summon and also a possibility of a jail term, depending on the country you reside. Not mentioning the CEOs company name will be tarnished should it happen. For more info, feel free to check out http://www.bsa.org/.

As for porn, it pretty much depends on the type of porn. Can't really comment much since it depends on country law and that your CEO does not care about his attitude. Well, a good start would be to keep all the logs of all the porn/illegal sites he visited. It may come in handy someday. Then, it's to silently trace all the histories on his laptop (registry and profile) to support your argument. If not, he may argue that it's all the pop-ups that caused the log entries.

by red_wolf9

Since the CEO most likely wields enough power to fire the entire IT department I would suggest a more forceful approach.

1) In our fine state the law requires that IT techs report instances of "illegal" porn to local law enforcement. What a shame it would be if his IP was logged visiting childporn.com... you would be obligated to report such vile filth.

2) Send a female member of staff to fix his machine next time he gets infested, have her file a sexual harassment complaint with HR or go for broke and file it with the EEOC.

3) Consult these links for more ideas:
http://www.theregister.co.uk/2004/07/29/bofh_2004_episode_24/
http://www.theregister.co.uk/2004/09/17/bofh_2004_episode_31/

by red_wolf9

4) If he's married... an anonymous phone call to his wife might be rather effective, especially if the caller is another female and the porn was described as "gay porn".

by oz_media

first of all, all this does is create work for the admin, lets consider it job security if anything.

If the 'porn' is not of an illegal nature, gee guess what? This guy is as normal as BIILLIONS around the world, otherwise the porn indeutry would be an underground venture and not one of the largest revenue streams known to man.

You will NEVER EVER be able to stop people from surfing porn with ANY stretch of your imagination. They closed down hen houses, the men moved to the next state. They shut down ONE porn site, 15 more appear. It's reality, until people can get a grip on reality they will fight against reality all thier lives, a truly uphill struggle.

so lets say you plot and twist and get the guy in a whole bunch of mess, his wife may not care about porn but his MISTRESS might, you bark up the wrong tree and you're fired for slander.

he may not be surfing anything other than legitimate adult paysites, again you call in the authorities you will be fired for slander.

You complain to HIS boss, who may also be surfing porn, you are fired for slander (lets see just who has the pull, the $65,000/yr netadmin or $200,000/yr CEO) again fired for slander.

What I don't understand is why all these former nerds hae become todays PC police. Playboys were in desks and staff rooms long before computers or the internet came along. if th eboss is a guy, you won't gain too much sympathy that's for sure.

Company policy? Only applies to the little people. Question it, you'll soon find out.

Company expense? You boss will fork out YOUR $65,00/yr to anyone in a heartbeat that will just do the job and repair/clean up the crap.

your boss will most likely not be willing to fire a $200,000 emploeyee because a netadmin is complaining of costs or extra work. Sorry, policy and theory are one thing, reality is another.

Why do you think it hasn't gone anywhere already? If it really WAS an issue of concern it would be addressed.

I had a boss who didn't gie a sh*t what people thought of his behaviour. he would outright tell the secretary she was a dumb bit*h and she needed to get laid. many had TRIEd to sue him, most failed. A FEW got a few bucks, most lost thier legal fees to poor lawyers, but they are out of work and he continues to run his business even more succesfully than ever.

All you are doing is being the squeaky wheel, but in this case it's cheaper to replace you with a new wheel than to grease you.

Focus on people that the boss cares about abusing his systems, it is't going to be the CEO.

I am sure he is more concerned about staff visiting Monster.com than his CEO surfing even the most disgusting and insecure porn on the web.

These policies are to stop "cheapo peon" employees from costing him money, I'm sure he pisses away thousands entertaining his partners and buying drinks and rounds of golf for the upper management.

by gaston nusimovich

The IT department is responsible for any downtime due to viruses or any other malware that gets into your company's network.

Even if your company doesn't suffer any downtime because of your CEO's wreckless behavior, your department has to incur in extra work to check after his porn-site escapades. The IT department should register all expenses related to his conduct and bill his office for these expenses.

Good luck !

by oz_media

Your boss will most likely be hapt to pay for any costs incurred by his less expensive emlpoyees time and will then start to think you are unable to do you job if you constantly put in OT.

He will soon realize that his $65,000./yr netadmin can't take care of cleanig up after his $200,000/yr CEO. the CEO isn't hired to pay attention to proper PC usage policies, otherwise you would not be needed and HE would be a netadmin.

Why does HE get paid more than you do?

Because his skills are VAlUED more thanm yours are. Stop trying to become a peer with a CEO, you aren't and never will be in your chosen field of work.

the guy making the big bucks, brings in the big bucks. The IT staff are there to stop other low paid staff from costing the company money, the CEO GENERATED THE REVENUE THAT PAYS YOUR SALARY.

Who gets fired?

by av .

I have blocked any sexually explicit materials for everyone on the network. Everyone agrees. I work for a law firm.

by lschindlbeck

Have your CIO send a message to a board member.
Unacceptable behaviour should not be accepted or brushed under the carpet just because it's the chief who is doing it.
What kind of example is he giving to his staff?

by toucan

Slowly strangle the bandwidth during porn surfing activites. Maybe you can condition him to avoid porn surfing. Plus you can secure the rest of the network from as many other issuse his machine may pick up.

Or generate those reports on web surfing activity from your proxy server. He might get tired of seeing his name in print.

by oz_media

You'll probably get a raise. Try and stir it up, you will probably need a job.

He generates money, you just save it.

by johnnysacks

Get a PO for hospitality services and procure the services of a hooker that can suck a golfball through a garden hose.

by bubbaonthenet

Keep in mind, that it is his or her Company. When He or She talks to you about how they were able to bypass or break Content filtering tell them that nothing is fool proof ?point out that even the antivirus application which is supposed to protect/prevent the workstation infection from the known viruses did not work.

Tell Him or Her that they are responsible for leading by example. Be frank with him/her that his actions do have an effect on the morale and Company's culture. Be honest and let him/her know that yes it has reached to your level and even lower to the level of your Technicians. Remind him that Technicians visit each and every User and Workstation in the Company ?that alone should do it.

Be Frank and let him know that the Appliance provides a certain level protection but it is there more for general liability to protect the Company from Sexual Harassment Lawsuits.

Realize whether it is the CEO or the guy in Shipping, viruses WILL enter in to your Network Environment: regardless of NOS and OS. Making a stink about the viruses is a mute point. Part of your Job is to address how you are going to manage the causalities from Viruses; not what your Boss or CEO does day to day.

Finally, be smart: he/she is the Chief Executive Officer --it is THEIR Company. If they decide to drive it in to bankruptcy or in to XXX Oblivion (which you should be thankful it is Porn-ron not Enron) then there is next to nothing you can do about it. You will be fired and can you really afford to sue your Company, ruin your name and risk losing other potential jobs when they hear about what you did? [Mike Dupris]

by av .

He has other peers that stand to gain or lose based on his actions. Everyone loses if he is an idiot.

I agree with your other statements about making him aware of why he shouldn't download porn, and that no protection is 100%. But I don't think you should give in to him. They hired you to run the network and he is an extreme security risk to everything. You can't let this guy run the network.

For myself, I would not be able to tolerate someone's porn fantasies on my network. If it was the CEO, I would ask him to set up his own private line if he wants to have that kind of access so as not to endanger the integrity of the network.

If thats not acceptable I don't care. I'm not going to compromise myself to accommodate him. And I wouldn't compromise the company's network by allowing him to download porn, etc. That would be turned off until he was off the network.

My answer is definitely different because I am a woman. I am not going to tolerate porn, I can't. So fire me. I will sue and I bet I could find a lawyer who would take on the fight pro bono.

by bubbaonthenet

I've worked for a private companies, non-profit and public companies. My point is: at the end of the day the Boss is the Boss. Look out for Number One: Yourself. I am not endorsing nor condoning his actions (staying completely neutral as yes I have responsibilities outside work, just like everyone else here.)

Surfing Porn on the Internet is just as dangerous to your Network as anything else is these days. People seek and share pointless information each and every day --just check your Email Servers.

Ultimately the Company owns the Network and the Data Created on It. We do have a say, to some degree, but the Company run by the CEO has the final say.

Yes, that bonehead CEO will still be browsing BigBoobs.com.

Of course the Company also must abide by Local, State and Federal Laws; but if you have a big dumb animal running the show he eventually will find himself without his job or company if his judgment is that poor and he ignores his professionals.

Your idea, AmericanVoter is great. I would even take it a step further by securing his segregated Network and name it "DomainX" where he alone is the only user.

Most Executives do not want to be part of the Network anyway. They would rather be as close to their wireless home setup tunneling in to the Network rather then hardwiring.

You eventually will come across a situation that will make you feel as passionate about it as you do with Porn. Whatever it may be, you will have to ask what you can do to meet half way. That?s the art of Negotiation, no matter if it is Porn or an unsecured wireless Piece attached to your Primary Domain.

You do not have to accommodate the CEO. Which is fine and it is completely understandable and up to you. That is your choice and freedom. I think you will have a lot of moral and legal support behind your decisions. Although there is a way to meet half way without loosing your respectability, compromise your network and come out of it looking like the creative innovator they pay you to be.

I am saying it is a bad no win-situation. It is not about my personal preferences, tastes or tolerances. It is about making me an accessory after the fact. Frankly I do not like it. It is about CYA and FYI. Documenting what you feel is fine but what is more important is the documentation of what you did and why. [Mike Dupris]

by marc h.

Who "Owns" the company is a question here. In my case, our CEO reports to the Senior Partners, who are the worst abuses of all kinds of policies. Our answer was a very simple one. START PUBLISHING THE USEAGE LOGS!

Peer Pressure works wonders!

by rajwar2000

At the end of the day its the End users Culture that matters.
If your CIO is supporting you, then the best way would be to educate them again and again rather than fighting.
If there is a strict IT policy that says that you can quarantine the PC's of policy violators, you should do so,
If there is no such policy, then the best part is to ignore.

by gsg

Every time he downloads this stuff, it sounds like he downloads a virus that you and your staff have to clean, and in the process find the pictures. For my part, I would find those pictures offensive, and since the CIO has told him to stop it, then any further infractions are sexual harrassment. Eventually, one of the employees will slap him with a harrassment lawsuit. At that point, the Board of Directors will have to fire him. Hopefully, you and and CIo have documented the times he's been notified of the risk, or you could go down with him.

by choppit

Internet access is made available for business use, so how about regularly circulating a copy of the logs to senior staff (so they can see what their staff are up to!) that way, they can speculate who in the company is surfing porn.............

by mlandis

All of the suggestions here are brilliant and to the point, but would be more easily applied to an employee under the CEO than the CEO himself.

Any kid in a garage band knows the "It's his basement" rule. His enjoyment of the porn sites is not the real problem. The underlying difficulty are the thrills he enjoys while exerting his power and control. Instead of going heads-on in this power struggle, go through the back door.

What if the CEO were given a second PC with all the bells and whistles on a separate ISP account? One is the company computer for business, and the other is for his own use, whatever use that may be. If he gets his kicks from beating the protection programs, he can do it over and over again.

Annoying as it would be, it's more cost effective to replace/repair one trashed drive on an isolated unit than it is to effect repairs on the entire network.

One PC is for work and one is for play. You would, of course, have to protect the network from his personal PC emails.

by mllwyd

This is, in fact, our latest ploy! I'm wondering whether or not he actually will use that machine instead of his laptop since it will require rolling his chair over to a different machine....

by mlandis

Only time will tell. He will attempt to email and drive you crazy, and will be frustrated because you have his ISP address blocked.

Can you have your real mail server isolate his emails so they are not returned to him as "refused" which will only get him started. You've been through all that already.

If you have any questions...

Maureen

by gryfon

Put 'porn machine' sticker on the front. Separate connection to the internet. He can surf all he wants, not connect to internal network, and there's only a few (so far) Mac viruses/trojans/malware/adware/dialers out there.

Seriously, the only way to prevent him affecting your network is to get him OFF your network when doing this.

Oh! Reset his homepage to Spywareinfo.com :-D Let him read for himself.

Hehe..anyways, good luck.
Gryf

by swalsh

when the ceo is out of the office, dowload lots of gay porn to his computer and make it a rotating screensaver..

by shirazrajwani

US military guys nowadays are enjoying their party in iraq. I would suggest the associates of company to better send him iraq where there is no internet nowadays. His habit will defiantely and drastically improve.

by packet spoofer

I would make sure to swap out the keyboard and mouse before working on his PC.....then I would probably A. keep quiet about it or if it was obviously illegal and I saw it... B. report it to the authorities....Knowing that most likely it would mean my job....these people live in a different reality than :"staffers".....

by packet spoofer

I could not resist....everything that could be said about it has already been said, so I figured a little humour might lighten it up a bit!
Scott

by mlandis

The source (you) or the topic. Often I see things here in the discussions that really raise the smarta$$ or the punster in me and it takes every effort to resist making any comment.

I was howling with laughter - I needed it.

Later,

Maureen

by packet spoofer

I am glad that you go a chuckle out of my comments.....that was their sole purpose...
These ceo types that surf porn all day while their minions do all of the work should leave if they can't play nice.....and I say if they can't play nice, they should play by (not with) themselves......
Scott

by ed g.

There doesn't seem much you can do aside from putting new filters up and/or looking at a vendor who will do it for you, e.g. WebSense (blecch!). Don't forget about blocking P2P apps too! As it's been said before, keep up the CYA e-mails and let the CIO take care of it. Good luck, hopefully his self-destructive tendencies will become apparent to others.

by rcom

What difference does it make. Your job is to secure the network and handle problems. Any website can be dangerous and there's no way of telling which will be a problem. If he's getting past your filtering then perhaps your not doing a good enough job and are exposing that fact each time you complain.

by robbie12

Suggest strongly you allow his machine to become infected then isolate it from the network. Due diligence works and damn the torpedoes.

by grewcockd

Take a copy of the 'surf log' and the 'company surfing policy' to your HR manager. It is part of their job description to deal with things like this, not the IT Guys.
Give it a reasonable time to stop, if it doesn't,
speak to HR about activating the formal grievance
proceedure.
Use your HR department, that is what they are there for!! They should be able to advise you on the exact course of action to take and relevant time scales.

by grbrown

Set up a routine that
1) Turns his speakers up full Blast
2) Audio that screams 'I'm watching gay porn'
3) Puts naked men on his screen (blurred of course
4) disable all shut downs except power button
5) Set to auto start at boot
FOR YOU
6) Key stroke routine to kill OR Remove his hard drive to clean
7) Trigger the routine when he's on Porn site

by piedad

Require the CEO to sign a risk-acceptance document which
outlines the risks of surfing these and other porn sites. Such a
signed document will not only protect the IT group from blame,
but can also be the basis for future action in case a higher party
wants to intercede.

by mtucker

I had a VP that gambled on the web. He would not stop when he was caught and talked to by my boss or myself.

The last time he was caught we mapped a drive to his admin share on his win2k station and deleted all the files in My Documents - we backed them up first. When he cried we told him a virus he got while gambling just like we warned him had damaged his computer and we needed to format his drive.

This took us some time but it solved the problem

by dhh13

This could be made to look like these sites mined his email addresses and sent these sites and locations to all.

by nkognito

The thing no one seems to mention? If he accidentally surfs into a Child porn site.
If caught? Care to guess how many computers the authorities will be seizing? More than just his.
If he has surfed into a child porn site and you have NOT turned him in? Charges can be filed against you, also. And just so you don't feel lonely? Anyone else there that was aware of his indiscretion.
But I think making the CIO aware of the fact that you could lose the CEO's computer, and, depending on who comes to get computers? Every server under your control. Every computer in your network, including a customers/vendors machine. (Looking for his stash)
All of us here know that they should come in and make mirror images of all your storage devices. Care to bet on it?
I had a similar situation, but lawyers owned the company, so it was cleared up fast.

by roger99a

You had best leave Captain Horndog alone. You can't win this fight. All you can do is keep good corporate anti-virus on him, and maybe schedule a spyware scan on a regular basis. Since you have already informed the CIO and made the hand off, keep your hands off and never speak of it again. The only person you can get fired it you.

by sandburr

Your goal is to protect your network. Slow his present workstation down disceetly however you can, slower connection, slow ram, or whatever, so it's not as fun to use to surf. Set up a second decent pc (make it cool and fast)off the network for him to use for his fun pc. Cloak it the best you can with off the wall name unassociated with your company, etc. Give him the talk about the facts of life. Pcs are not necessarily anonymous on these porn sites. Blackmailers love high profile porn lovers. Credit card info is not necessarily safe (if he's going that far). Then, image it and when it gets screwed up, reimage. This is your workstation and this is your pc, this one's for work and this one's for fun. Your network is protected and he still gets to satify his addiction.

by w00t

Tell him you are offended by the material and request he stop. If he doesn't let him know you will file a lawsuit about sexual harassment in the workplace.

by w00t

Tell him you are offended by the material and request he stop. If he doesn't let him know you will file a lawsuit about sexual harassment in the workplace.

by wilros

That sounds like the quickest way to the street to me. Use diplomacy, after all, we have the power. Setting the filters to deny all then allow only a few is the best solution. He has no power in the technology because he probably doesn't understand it (like many CEO's).

by rosaticrew

If the company has a written policy on internet usage, it would be time to enforce it by shutting down the CEO's access to the internet. At places where I have been, ALL employees had to sign a copy of the internet usage policy and everyone knew that it could mean loss of their job or access to the internet.

by mark.johnson

vlan his port straight out to isolate his PC from the rest of the network.
He signs the paychecks so its his network just make it safe for everyone else.

by kpdriscoll

You've done your due dilligence and documented your findings and recommendations up the chain (key word is documented). The bottom line is that the CEO is responsible for the company. If they choose to act irresponsibly with company resources, it it within their rights. Keep the resume fresh though, if their vices outweigh their willpower, their scorn likely outweighs their ethics as well.

by gentlerf

But I noted in all the previous postings one key datum missing: what kind of porn is he downloading. If it is kiddy porn, then it becomes a matter for the police and FBI as that will be the only way to remove the CEO. If it is not, then do what you can and try to negotiate a better job elsewhere. And as always, document these incidents to CYA.

by jeffrey.schneider

Next time he gets viruses and spyware from the porn sites, pretend to clean up his machine, but don't and let the OS self destruct or secretly shut off his network connection. Then maybe he will learn the consequences of his action.