Am I A Tyrant?

.
I have worked for big and small, and this sort of issue comes up nomatter what the policy. You are doing the right thing, but get your CIO or equivlant to set the policy. Then its your job to tell the users "sorry, its not MY policy, its the COs."

The company I currentley work for has grown alot. When I came in, it was still suffering the sort of mom&pop mentality. We had to shift gears, and some older employees resented it, and the control IT had over "their" PCs. It will take time, and the managements backing to make policy stick.

Don't back down. Get some help. Put it on paper, and publish for the users.

It is absolutely IT's responsibility to decide what users can access. It's important to keep out the spyware and freebie software crap that people download that usually breaks something. I think the others just don't understand the security risk and bandwidth usage.

I recommend documenting your concerns and pass them to your supervisor. Let them know the threat and how much time and effort is wasted trying to fix problems that could have been easily avoided when you could have been working on something important.

If the brass doesn't seem to care, get a trial version of surfpatrol or equivalent. Get documentation on where people are going and at what times (you should let the users know in advance before using it). Also see if you get trial software to show network utilization (or your ISP may provide this information on request).

Perhaps the managers will reconsider when they see what their employees are doing when they should be working.

You have a 768 for how many? If they, and all the business apps, are using the same 768 line you MUST keep them from killing themselves with nonsense. That just isn't a large pipe for a whole company to be surfing at all times.

My company, a partnership of a few hundred lawyers, has two T-1 connections to the internet. They simply won't allow us to block much, so now we're going to a T-3.

The cost is worth it to them, but in the meantime, they are preventing themselves from getting real work done [internet research sites that charge per minute] whenever they stream the latest tsunami footage, etc.

If they want a loose policy, they have to get more bandwidth. Don't wanna pay for the conenction? Fine, live within your means.

I've always had a problem with restricting Internet access. Mostly because it is rarely done correctly. Yes, if you restrict access site by site that is fine. But when you only allow certain types of traffic or certain web sites, you will invariably restrict many usefull sites as well.

One common target of Internet restrictions is to prevent access to discussion boards, like this one. I worked one place that would not allow any NNTP traffic. Eliminating newsgroups as a place to find information. Many offices restrict instant messaging. My wife is also an IT manager and we bounce ideas off each other through AIM all the time.

The better solution is to write effective, enforcable policies. Then educate your employees and trust them to follow the policies. If you can't trust an employee then that employee needs to be fired.

(And you thought you were a tyrant.)

Well, it really depends on who is doing the screaming. If it is the end users, ask them to submit official complaints through their manager, and that they can have their manager request the access they want, if it is OK with the manager of the department, why not? If the Managers (your higher ups) are complaining, usually because the link to their latest lewd joke doesn't work, give them the access, but recommmend coming up with a policy and enforcememnt. Meet all department heads and get their views, let them know what you want to implement, timeframes, etc. Spontaneously locking things out tends to cause more headaches than it's worth, get the management on your side and implement it over a short time frame, with all staff being aware ahead of time. It would be best to have this in place before bandwidth becomes an issue, so you don't get yelled at for "not seeing this coming".

Cheers

-DW

You have to be realistic and accommodate that. People basically live at work and you have to let them do the things that involves if you want them to do good work and be loyal to the company. If that means spending money on more bandwidth, in the Information Age it is probably the single dirt-cheapest thing you can do to improve morale, productivity, and quality.

Absolutely you have to make sure they're not doing anything illegal, counter to the company's interests, or flagrantly inconsistent with the local community standards. In other words, if you're in Hollywood you'd better not filter out pornography!

Other than that, the same rule applies that I tell every wannabe manager: There's only one way to manage people, and that's by using your people skills. A good manager simply knows whether Joey is playing poker or whether Susie is a e-Bay addict. He doesn't need an elaborate log to figure it out. If you can't do your job and manage people the old-fashioned way, then you've got no business being a manager in the first place.

For all practical purposes, we live here in your ****ing office building, primarily because you dinosaurs who are under the spell of the energy industry won't let us telecommute from home! We have to be able to live all the dimensions of our lives here, to a reasonable extent. Learn to live with it!

That's fantastic. Still have a copy of that test, it may come in handy.

You're right, I'm not trying to attack any employees, but I have already had a three day episode fixing Netsky on my network. And that was before our fouth branch opened and about 20 employees ago. So, it already did happen. It was a download from a freeware / game site.

I wouldn't sweat it man, you're just doing what you should be. The company should see what you are doing as a favor to them. By allowing the flow of work to happen instead of the flow of downtime...

Though I will admit that I LOVE my internet radio when I forget to bring in my Mp3 player... ;p

First off, speed and reliability are 2 seperate issues. The average cable connection will be 4-5 times faster than your DSL connection. So, even though you now have "stable" transfer rates your users will see speed differences.

As for where I work, I don't make any decisions on what to block or not block on my own, outside of P2P. I make a lists of bandwidth offending protocols and wait for my boss to tell me what to block. If you were "laid into" by your end users then so be it. If it were management you should take note and don't assume that it's your call to make. From the tone of your post this seems to be the case.

Good luck with educating management!

No company expects (or should expect) every employee to be working hard every minute of the entire business day only on business. That's how people burn out.

Lots and lots of companies provide onsite health clubs or memberships in local health clubs, noon time meditation groups or chair massages, and any number of other ways to break up the day. There have been innumerable studies showing definitively that people are more productive when they take a ten minute break every couple of hours.

The "best companies to work for" lists routinely include organizations whose employees report that one of the main reasons they like working there is that they feel treated like adults and professionals. Of course there are plenty of folks who can't be trusted to get their jobs done, but that's a management problem and not something that can be regulated or solved by technology.

I have no problem with IT enabling a little non-business oriented activity, so long as it doesn't interfere with regular business and has little to no incremental cost.

It isn't IT's job to tell people what to do...or NOT do...with their time.

If the boss has his staff complaining that they cannot get to buy widgets or see PGA results it is completely within his right to pass that on to you.

Seeing as he/she probably had really steamed encounters with these PO's employees, his encounter with you showed the same face. This is how most corporate ladders work too.

In this case,just allow what the perosn owning the company wants you to allow. I am sure they didn't understand the scope of the policy when it was written, this is common. For an employer, a written policy is merely a way to reduce lawsuits if they fire someone for abuse of the systems. For the most part it is there for protection not enforcement.

Just open it up and let them have what they want, if that's what the boss wants.

He will be getting enormous billd from the ISP as most business services charge wen you go over a prepaid limit. They will start charging for all the overage each month, when he sees these bills he will either;

A) come screaming at you again, completely understandble and expected. That's the way it is.

B) Start asking users to reduce use of personal services (streaming audio/video)

C) Ask you to block access, in which case when they come and complain to him agin he will say it was his decision and it's just too bad for them!

One question you must ask yourself. Do you get paid to do this? If so, you are also being paid to put up with it.

Just play puppet in those situations, "you're right, I should allow them some perks in their hard day!" and then "You're right, I should lock down some of these services to save bandwidth" then "You're right, they should have these services at the desktop"

One thing that is ALWAYS true when you work for someone. He/She is 'RIGHT', end of story.

You are simply paid to do as you are asked by the person who employs you, and then redo it, and then undo it,and then.....you get the idea.

I may be creating some controversy here, but I strongly believe it is not your place as an IT dept manager to be dictating corporate policy. Your job is to do your best to provide the best possible IT services to your 'customers', which in this case is the corporate employees. If the top management has given you explicit authority to control what employees can and cannot do on the Internet, that's different. But I'm guessing that is not the case, or you would not be posting this for our discussion.

Take the issues to the top management, along with pro's and con's of unlimited access vs. restricted access. They are the corporate policy makers, not you. By making these decisions unilaterally yourself, you are setting yourself up as a 'fall guy' who will be universally despised by users. If users cause loss of productivity by their abuse of 'surfing the net' on work-time, that is an issue for the executive suite to handle.

You are letting your executive managers off the hook by taking this issue on yourself. I certainly would NEVER put myself in your position.

Is the effort of locking down categories toward some specific goal? If not, you're a tyrant. If so, you're not a tyrant.

You mentioned bandwidth use. If the amount of data being used to do non-work related surfing is using up enough bandwidth to adversely affect work related surfing, then you have a specific goal for cutting it out.

If the non-work related surfing is illegal or violates company policy, then you have a specific goal for cutting it out.

If adverse consequences of surfing cost the company money in, for example, access to malicious sites, then you have a specific goal for cutting it out.

For any of the above, you're not cutting out the surfing to be mean. Though, the reasons for doing any such actions should be well documented and vetting with management.

after 8 hours regular time, it's time and a half, to a total of 8 regular hours pay, then double to a total of 8, then doubled again to a total of 8 hours paid.

so, if 20/hr for 8 = 160
then at time and half, it's 30 / hour, for 5.3 hours
then it's 40 an hour for 4 hours
then 80 for 2
then 160 an hour

it can be really nasty for employers that didn't keep important projects on track for completion huh?

WIth lawyers in the family I have been able to sue several of my past employers for various reasons, usually HR related.

I was recently approached by a US company wanting me to start branches here but have people work from home on straight commission. After explaining to them that BCESB (the old Labour Code replacement)mandates they would be out nearly $6,000 month before getting started they decided to try and operate from the south instead.

There are MANY ways for an employer to avoid the minimums you have stated, the most popular being an averaging agreement, in which they pay you NO overtime no matter how long you work. But only a fool would sign one. I have made an employer sign one though, in order for me to recover 2 years of unpaid overtime, long story, but much the same as the Keg issue. My brother is the enemy really, he represents corporations, but he's good to have on your side when needed I suppose. Others are industry specific, such as freelance artists, unsigned bands, real eastate agents, life insurance sales and a few other specific trades that all have different exceptions to the minimum wage rule while still being tacable employees.

The BC Employment Standards act is actually the same as every province in Canada with the exception of minimum wage and some taxation issues in Alberta. The BC Labour Relations Code was written mainly to support the employer whereas since it was standardized it was ammended to support the employee instead.

Just another perk I suppose, plus it keeps competitive business fair and the marketplace equal.

I didn't say the new connection did not have a speed problem because it was more reliable. Until this point, decision making about our content was my responsiblilty. I have already conceeded to the difference between management and IT. But nothing is set in stone. At a company where everyone wears many hats, the lines are grayed.

By the way, even in my little hick company we do 8 T1s to deal with and Citrix coming soon, but thanks for raising yourself up so high.

Providing you have a clear and comprehensive acceptable use policy, approved by and signed by top management, you just post it to users and tell them that any site they can't get to is because of that.

If they want to argue and whine, let them do it to their managers.

Surfcontrol is better. Limit everyone to an hour's personal use a week, so they can check the PGA or shop online during their lunch hour. Block porn or other anti-social sites, or ones that could for whatever reason be detrimental to your business or your colleagues, but do it when your management team have asked you to and agree with the reasons for doing it.

Only someone really dumb would use the internet 10 hours a week for personal use when you are collecting surfing information, then whine to top management about their access being controlled ;)

Your policy should clearly state that computers and the internet are provided by AND OWNED by the company, and therefore privacy rights don't count. You have to be able to monitor email and internet traffic for security reasons.

Talk to your legal and personnel departments, or get your boss to do it.

Takes time, but no, you do not want to be the one seen to be making up the rules, merely enforcing them. If people choose to break the rules, it's the company that takes action, not you.

You are not being a tyrant if you are working to Save the company money and maintain/improve efficiency and productivity. Every employee should understand this basic principle.

If you can't get an ally in management to see the risks with the way some of the employees are using your IT resources, make an old-fashioned Paper Memo detailing a couple of specifics and then the general cases you need to address. Send Copies to more than Two line managers or relevant supervisors with the target address of the memo to the Division Mgr, VP. or company Head Honcho. Write the memo so they can see the risks in terms of Costs and potential losses/liabilities.

The line managers or supervisors should get orders to help you work out the policies or restrictions that meet company goals and employee needs.

If the memo is reasonable and completely ignored, put out your resume and find another company.

Gulsath:
Do not feel bad about doing your job.

I like your approach of using a consent form for accessing non-work realated sites and combined with the fact that this should only be out of working hours I feel that you are enforcing the right image and usage.

You have your usage policy, that I assume all staff have signed and agreed to as part of their employment conditions, so quote from it and enforce it.

I have gone as far as excluding hacking, gambling, banking and shopping sites along side the usual raft of sites. IMHO I think you could also block internet radio and IM since there is no need for them whilst you are at work.

You may have other techies that need access to hacking sites but make sure that they have signed an exemption form stating the T's & C's under which they get the access.

Hope that helps.

-Mark

We find in larger organizations the amount of web "goofing off" - and so presumably the risk of inappropriate surfing - rises with distance from management. A copy of the "Web Usage by user report" sent to the appropriate manager usually is all it takes to get the manager to re-inforce policies that reduce surfing be it:

- clearer policy
- employee training
- site blocking

In some smaller organizations we work with managers allow general surfing as long as:

- the employees have received appropriate use training - which includes a security risk summary
- employee performance targets are met

In those organizations bandwidth costs (for the many differing Internet Radio Stations) are seen as a cost of doing business and appropriate allowance is made in the budget.

Support costs caused by the employee downloading bad content that causes a service call are "deducted" at time of their performance review

I am under the impression that most of the replies are from people who are not in a position to apply such policies - but whatever anyway.

Gulsath, I am in the same situation and from what I have read you have got quite a time on your hands, my suggestion is that you put a speed limit (without telling your users) on non-work related sites during business hours. Yes one could argue that the users will then spend MORE time on the net because it is slower - this will infact happen but it will allow the users who have work and those who want to work to get something done.

My argument to support blocking is quite simply this - do your work and bring in income for the business to continue - no business no work, then everyone is unhappy.

Another point to consider is posting or e-mailing the line stats to relevant managers to inform them as to what their subordinates are doing during work time (I think that you will have to get approval for this) - I don't say that when you are at work you must work 100% of the time but effectively that is what you are paid for and the terms you agreed to when you said "yes I will work here for that amount at those times".

Oh well back to work for what I am being paid for...

Before I was able to use p2p to download any files, from adult to documents. And I was the one who usually fix the office computers if they're busted with viruses and other destructive progs. I was aware and still did it.

Now, I know that your users know what will happen if they don't follow policies being implemented by IS depts. They just don't care. And the most important thing is policies are so easy to ignore, especially when it comes to using the Internet. It's like "Hey! It's public anyway. I have rights."

No. You're not a tyrant. You just felt it becuase maybe once you were also in our shoes and your Net admin did the same thing.

Best regards.

I am a CEO of a technology consulting firm with many years of experience in large and small comp-anies.

As long as modern organizations continue to blur the boundaries between work and non-work life by giving employees cell phones, home faxes and home PC's to access their e-mail they will have to provide some portion of the "regular" workday for employess to get some of their personal "stuff" done.

Although it is a security risk to surf non-vetted sites, it is also not the employees problem to be responsible for malicious websites.

We need better web security and bigger punishmen ts for web abusers and a little more consideration for the emerging convergent lifestyle.

Have a good one.......... RSC

Gulsath,
With over 15 years as an IT hands-on guy and director, I know
feel your pain. You have a manager and if you are feeling heat
over implementing the word of the policies, then either the
policy needs to be changed or the manager needs to send a
communique that explains why - no exceptions.
To help your manager send that message, undo the settings on
SonicWall, and then run reports on bandwidth usage by user that
the SonicWall can provide you. Unify the IP address with your
DHCP server output, so that you have time stamps.
Roll that up with a weekly bandwidth utilization from MRTG and
you can build a good story for either purchasing more
bandwidth, or opening someone's eyes that this is a company
resource, like a long distance call and it does indeed cost.
You are always going to have users who think the rules are not
for them - this is where a good manager steps up and either
does the right thing or brings the security policies in line with
the corporate attitude.
If you are the top IT guy, then you need to craft your report for
the layman manager, otherwise their eyes will glaze over.
In my experience, it was the same ones who moaned about not
having access to eBay who also didn't want to change their
passwords.

Good luck!
Greg

Gulsath, in my experience of heading up IT departments, these type of restrictions never go down well. All you need to be sure of is that your policies act in the best interests of the company. Internet radio is one that I typically let through - we were on a flat rate connection and if people want to listen to the radio during work, so be it.

My restrictions have typically been very light, eBay and shopping sites I have no problem with at all.

The key to a succesful company is happy and motivated staff. It is important to maintain this feeling, and to be cautious not to bring in a parent / child feel to the way you restrict access.

My 2c worth...

P

Actually, it is not up to IT to decide what the systems and internet usage are. We just enforce what management says to do. If management wants to throw out or ignore a policy, they probably didn't understand anyway, it is their nickle. Just document the progression of events and what steps you attempted to avoid problems and the violations involved. Documentation is a key to your protection and the ability to get things working the way they need to.

It is ITs responsibility to make management, no matter how large or small the company is, aware of the hazards and problems created by having an open access policy.

It only takes one large problem, system infection or lost customer due to an open access policy and they will sit-up and start to either create or start enforcing a controlled access policy.

First thing I see is that you work at a credit union. This is a financial place. I would let senior management know that malware is out there on the internet and to allow people to surf were they want may expose the credit union to litigation. If financial data was relayed via this hidden software, then anyone of your customer's financial data could be at risk.

Working at a financial institution requires the strictest of policies, because your not just at risk with the credit union's money, your at risk with every single member's accounts. If your company chair cannot see this the costs that could be involved, then I am agasp.

Opening up your company and other's accounts to possible infiltration, theft of information is something I would try to strike a cord with them. They understand money, and not just waste of time money. They understand lawyers, and litigation.

I have all the responsibility and none of the firepower to enforce a policy that is 1 paragraph long. It basically says, if too much personal activity is noticed, we will have to curtail it. I bought spectrasoft and installed on the 5 largest offenders, based on the reports from my Watchguard Firewall appliance. The reports I drew up after Spectrasoft was in place for 15 days, looked at 3 random days for each person and showed date, site, time site was open, time site was in the foreground and active(to eliminate the excuse that it MUST have been a pop-up). The lists on each person showed a MINIMUM of 2 hours daily - not BEFORE or AFTER working hours, and NOT during lunchtime, but in the prime of the work day. The sites were shopping, jokes, checking personal AOL, HOTMAIL and other email accounts, e-bay and of course - Fantasy Football.

I was forced to open up the Sports and Leisure sites on the Firewall list because too many of the upper management members are involved in Fantasy Football leagues.

I have documented everytime that I have been forced to back down the strength of the system security.

I know I will be blamed when a shutdown occurs, however, I will have ammunition to refute that blame.

Any IT Admin that works in an environment where the buy in from above on system security is strong, is indeed lucky!

However, you should monitor the bandwidth, and then evaluate how much is being used for "non-work" related issues, then approach your management and let them know that due to the internet radio, chat, streaming video, golf scores, weather updates, mp3 downloads, etc.... that you need to up the internet connectivity bandwidth by x% at x$ per month/year. Then let the business owners/managers decide if they want to pay that amount to have people wasting company resources.

If they have the budget, and this is what they want to spend it on, then it's not IT's responsibility to stop them. It is IT's responsibility to let them know the financial impact of it though.

IT should not be the corporate nanny. If you purchase certain products, like Checkpoint Firewall, you can give the rights and responsibilities of managing net blocking to HR. (No I don't work for Checkpoint)

They are the ones who have to deal with issues of rights and corporate correctness. Also it keeps them from pointing the finger at IT because someone happened to peek into the cubicle of someone else who was looking at "inappropriate material" and decides to file a complaint citing a hostile environment.

It is a combination of what you are hearing here. There are many Fortune 500 companies that do not allow Internet surfing during business hours. Their reasoning is that a person that comes to work is there to work. Still in others such as Ford, they institue a proxy login to allow only certain people to get to the internet and surf about. Still others allow it all. I think you need to do as others have stated before develope a presentation and bring a machine that is infected with some really nasty sypware. These visual aids along with real time data showing cost of work realted to fixing PC issues and worker down time along with bandwith utilization cost will sway most of the people in management. To illustrate say you have 25 infected PC's taking 2-3 hours each to fix, then your time at $30/hour times 3 times 25 equal 2300 roughly. The next step is to show that cost of surfing against the cost of your T1's for the month. And on and on till some one in the room says "Wow! we are spending that much??!!" or "Who is working here???!!".
Make sure the presentation only presents data, when you cross the line to oppinion then you will run a foul of the "Great Place to Work" feeling. This in itself is a tight rope of grey area. How much do you lock down the machine without making your office feel like a cage. How many sites are blocked to protect/impede needless internet use.
There are alot of vaild points and ultimately it will be Management that makes the final call. Just make sure it is the right one for your business for business reasons. Get your ducks in a row and make your data air tight. Less leaks the less of a chance there is that you will not get your policy implemented for the right reasons.

Are you a lawyer? If not, or if you do not provide legal counsel to your company don't sweat it. The reason a policy, intended to monitor or control employee behavior, is implemented is to show that the legal entity of the company does not support or condone the illegal or offensive behavior. Thus if an company is sued because an employee of the company did something against the policy, the company would have a better legal position in court.

If the higher ups want to disregard the policy for certain people or at certain times then the company is again subject to litigation becuase it can be argued that it was a policy on paper only and not implemented and inforced at the company.

Think how much fun an opposing lawyer would have when they found out that the company ingored a serious policy. What other policies might also be ignored? Maybe age, sex, or medical discrimination, wrongful termination policies, etc. The companies legal defense would be that much harder and more expensive (legal fees) to defend.

An interesting idea: Go out and surf all the porn you can. Show it to everyone who will look at it. Get fired. Then sue the company for discrimination becuase they only enfored the policy they had against you and not the others who had also violated policy. (this is not a recommended course of action but an interesting idea)

The problem is that you have become the defacto enforcer of this policy. Probably, the HR or legal department should police the enforcement of policies, just like they would for a drug usage policy.

Your company management needs to decide if they really want the policy. If they do then enforce it, if they don't then modify it or get rid of it.

I realize that you're more interested in a policy paper than a technical paper but maybe this can help.

The sonic wall firewall has a blacklist of sorts. If you employ it it blocks a lot of internet sites. If you choose to forego the automatic blacklist and put in the domains people shouldn't be perusing you will gain a lot more control over what is being blocked but you'll have to work harder.

Is there really a great reason for blocking www.espn.com? Are people so incredibly irresponsible that they will waste hours and hours of work time and waste precious bandwidth staying glued to espn? As far as I'm concerned, if you're not doing real time internet work (like online investing) you can live with a little bandwidth clutter AND it will get some of the workers off your back.

Of course this is a matter of policy and you should have the backing of the powers that be but by implementing a clever little hosts file (check out http://accs-net.com/hosts/get_hosts.html to download an excellent solution to fighting spyware) and by manually blocking places like bittorrent.com you're going a long way towards protecting your network without annoying your coworkers.

You're trying to do a good thing but you're trying to police the network a little too much.
I suggest finding a balance. I think you'll find that if you give people their musicmatch.com access and block the likes of kazaa, you're doing precisely the right thing.

Load up this thread at work and let the Management read it.

I've just finished a XP rollout for a major mortgage company. They were still on Windows 95 and the users had all kinds of spyware and virus's on thier systems. The emplyees were advised of the rollout far in advance and made aware that internet usage would be severly curtailed with the new OS. It was a highly customized install of XP to such an extend that people that had company units at home had to bring them in for imaging. Needless to say when they used them at home for work thier internet connection was routed through the company vpn and server which allowed the company to enforce the IT policy very effectively. If they wanted to surf the net unrestricted they had to use their personal computer for it.

At the site I worked at the IT department doesn't set policy, that is controlled by the company home office. Any changes to internet access was modified from the home office by remoting into the local servers.

All of our users must go through a web proxy to leave our facility.
This proxy only allows access to the sites that are entered in the list.
Only the sites that are required to do thier jobs.
With this paradigm, you can not really say that we are blocking anything.
Internet access is not a right of employment, it is a tool.
We are using it to save money and time by not requiring the employee to have to make a phone call to get info or order a parts catalogue and wait for it to be mailed.
To be Employee friendly, we have also allowed access to banking and news at lunch time.
And for new requirements or imediate needs, we also provide a "research" terminal that has full Internet access. This machine is out in the open so there is no funny business going on with it.

I gues I am saying that your company is using the wrong paradigm regarding Internet access.
Is it to check PGA results or is it a tool to do business faster and cheaper?
If it is the first, you might as well just cancel the connection completely and save money.

It is for exactly the reason that you point out that many organisations (at least is Australia) are moving away from URL filtering and blocking but are making use of monitoring software like the excellent WebSpy. By using a monitoring software, and letting all staff know that you ARE proactively monitoring (which can be done even by the local managers rather than IT staff) and incorporating that into your AUP you alleviate your burden. You still can provide a full report for management with all violations (e.g. weekly or monthly) and by whom. I know from experience that the results are astounding and once staff experience that they indeed are being monitored during offie hours you will also gain back some valuable bandwidth.
And YES, IT is not the Internet police, regardless of policies. If management has no buy-in into their own policies then they will never be upheld anyway.
Hope this helps...

Tyranny isn't the issue discussed. You were hired to do what IT people do. You were not hired to be the morale, moral, productivity monitor, social conscience or anything other than the 'IT Guy'. The question you posed comes up over and over. IT people seem to think because they have the 'keys to the kingdom' they have to apply subjective judgements with respect to all things related to IT. The fact is simply, you do your job and let all other operatives of the company do theirs. If the 'boss' doesn't care, then it is not up to you.

As to policy, by definition, a policy is a broad guidline for operating a business. It is not a license to specify who does what to whom and when. All you need to do is your job which may include informing principals as to pros and cons of using assets which you have been hired to maintain and take instructions accordingly.

No, you are not the moral conscience for the company. You are not the productivity monitor for the company. You are not a 'tyrant'. You just have forgotten what your function really is.