CEO surfs porn

IT works for the company, not the other way around. If the CEO chooses to access the Internet as he/she chooses, so be it. As someone else suggested, just make it so the company network doesn't get compromised. Give him a separate Internet access. If a change is ever to occur, it will come through the CEO's actions, not anything anyone else will do.

Additionally, a business policy is a broad guideline, not a hard, fast rule. I am amazed at how many of use choose to put our 2 cents worth into this comment. We must ALL be pretty fascinated with 'porn' Is everyone just jealous?

HR and corporate attorney are good contact points. The key issue is now Sarbanes-Oxley. Any employee, paricularly the CEO, who repeatedly infects their company computer is jeopardizing the integrity of the company's financial information.

Web-borne infections now include keyboard loggers, remote control and trojan software. Anti-virus vendors are just waking up to this threat. The malware evolves so rapidly that it is hard to find any product that gives full protection.

If the CEO's machine is compromised, it opens access to a lot of confidential information. Probably also gives an attacker the ability to change key numbers. The CEO is liable to prison time if he / she signs the SOX statement about the accuracy of the company's financial statements while engaging in behavior that jeopardizes that integrity.

I would present this as a compliance concern to the CIO and Chief Counsel - "I'm worried that our CEO won't be able to sign the financial statement this year. Their PC gets infected so often that we can't be sure our financial system hasn't been leaked or attacked through that machine." You have educated your management about the issue and done your job. They can decide how important the issue is.

FIRST OF ALL, wear rubber gloves when you use his mouse and keyboard! Good chance of stray DNA.

This is a no-win situation.

Protect the rest of the company from infections that he may bring in. Can he be put in a DMZ?
Secure his PC as much as possible.
Make sure it has all the patches.
Turn off active X and Java (if he hasn't already) as well at the "install to desktop" and "paste vis scripts".
Maybe even move him to FireFox to reduce some of the exposer.

After that is done, just document EVERYTIME you have to stop working so you can clean out his system.

Maybe the company would buy him a subscription to Playboy to get him to stop placing the company at risk?

Enforcing company policy is not the job of IT. You detected an issue and notified the correct people. It is now out of your hands and you will only get your walking papers by trying to enforce something that you don't have the authority to enforce.

Good Luck.

Using a purpose built firewall appliance maybe the answer to your problem. With a unit like the ones from Fortinet you can use it's content and IP filters to severly restrict porn sites rather easily even if you are using DHCP. If he has his own IP it's even easier. We had a problem with only 1 employee, but we bought a unit for under $1000 because we had a repeating virus problem in other networks. The unit will handle up to 2000 users, has a DMZ, and one of the best policy systems on the market. Cured our virus problem right away and at the same time cured the surfing problem. Our unit (Fortigate 60) stays up to date automatically and is relatively maintenance free.

Knowing which battles to fight and knowing when to leave are two of life's biggest lessons. If it eats you up, leave. Your other options frankly suck.

There seem to be two problems. One is that the CEO is a pervert. The second and more serious is that he causes security problems within the company.

There is probably nothing that can be done about the CEO being a pervert.

On the other hand, something can be done about the security problems. These security problems are generally associated with weaknesses in IE. The simplest answer is to replace IE with something like Firefox, which doesn't seem to have security problems. Or at least, the security problems, that it might have, are not being exploited by the malware writers.

This simple change should be sufficient to solve most of the problems associated with security.

As far as the boss being a jerk off, he's probably not the only one ;)

Ian

I agree, the CEO SHOULD be fired. In my company, all employees must sign an acceptable use policy. By signing that, you agree to use the technology in a certain way. Violations of that policy could lead to termination. The problem is that because of position of authority, laziness or fear, these policies are not enforced as they should be.
I would make sure that the CIO has documentated when the CEO is caught and the fact that he has talked with him on more than one occasion. Then I would turn that in to the HR department.

Job done.

Make sure you have another job to go to first.

Seriously though picking a fight with the CEO is like pissing against the wind. Let it go.

Just as a FYI the banning of alll sites containing certain words falls flat on its face more times than you might think. I seem to remember Scunthorpe council workers not being able to access their own site as pretty good example....

Then I probably shouldn't encourage you to read Spider Robinson's Callahan's saga.

He may be a CEO or any other person. he has shown you that your network is not properly protected. you cant go and tell the users "do not visit porn sites". you should have proper firewall, desktop policy, proxy etc. so that they cant go through that. if u fire him then you will get backfired that you are not doing your job properly, anyone can visit porn sites from our organisation, hehehehe. I am sure he didnt asked you to allow him to see porn sites from protected network.

2 choices:

1.) Notify local press about his actions but document how many times he "tests" prevention devices or systems. With corporate scandals being what they are, the press should/would take this on.

2.) When scanning his PC, make sure he hasn't downloaded any child porn. If he has, that's a felony and you are required by law to go to the police! Period.

As he is the boss you may be biting off more than you can chew by taking him on.
However there are non confrontational ways of dealing with him. There is a great product out there called Securewave Application Control Desktop- www.securewave.com - which works on the white list principle when running software. If set up on his machine - and others - you can control what runs in his environment whilst auditing him at the same time.
If he downloads a virus/trojan/worm etc securewave won't allow it run saving your tech team a great deal of work.
If in the future you are able to take action you'll have an audit trail of what he's done.

Great product, and I don't even work for the company.

If he is just trying to ?beat the system?, then lock it down further. If you see that he does get to a porn site, block the IP. Most firewalls have the ability to block by URL and have ?Banned site? filters. Some firewalls even have content filtering that stop specific types of files from being downloaded. Better yet, setup some logging to find out what he uses for work and only allow him access to business sites that he has accessed in the past.

If he only wants the porn, show him how to get it safely and securely. There are plenty of legitimate and safe sites out there. If you can show him a way to access it more efficiently, he?ll think you ?fit in with the culture of the company?.

Don?t bother fighting with the owner?s son over this. You?ll never win.

The Simple answer is to turn over evidence of this behavior to your Audit team. This
could result in a board review and CEO dismissal

what the ceo may not grasp on the technical side of this situation i know he will understand in the cost factor. track the time that it takes you and your staff in dealing with his horse play. and then have the cio present it to the ceo. this may help to shed some light on what he has to pay out for his lack of understanding.

Many people have been coming down hard on the fact that porn is "allowed" to get through the security levels in place. Of course this should be investigated, but the reality of the situation is porn, like spam and viruses, is the slippery eel of networks. you can filter key words all you want, they will find pseudonyms. Block an IP and there is a mirror site that bypasses it. Usage policy is an honor system that needs to have real consiquences when broken. How do you hold up the policy makers to their own policy? Remind them of their role as examples to the company.

This is a raw situation at best. However, I agree with an earlier comment. If the CEO can work around your security settings, then YOU and your network staff are a bigger problem. Maybe he is testing you and looks like you are failing.

I think your comment is a bit harsh. A person asking for advice shows intelligence. Remember what we learned in school?
"There's no such thing as a dumb question."

The great thing about this dicussion is that it stimulates thought on the issue as at one time or another, we might come across this problem.

Have female employees 'caught him in the act' so to speak? If so, there may be grounds for a sexual harrassment lawsuit against both the CEO and the company itself. Perhaps the CIO could use that as leverage to get him to stop.

Sorry but there is nothing you can do about this one other than double your efforts to eliminate the possibility of the CEO getting through your web filters.

Think of this as an opportunity to shine. Given enough time and effort you can nearly eliminate his ability to go to any porn sites. Also I'd download the latest virus defs to his machine every single day.

When you protect the network from him regardless of what he does, then in my opinion you are going to look pretty good. He'll have to be impressed with your ability to manage the network. If you are presented with a dilemna, however, where he can get through and you can't stop it without purchasing additional software, however, then you should find a solution and present it to the CIO in a general way.

"There is a potential threat that we cannot stop. A user can install *software* and get through. So I propose we purchase *software* to eliminate this threat"

I only see this as good for you. You'll get a lot better at internet security and become more proficient at your job. You'll look better to the CIO and CEO in the process.

This is probably illegal, but he should be warned one more time by the CIO that if he continues to do it, evidence will be turned over to the corporate lawyers for a lawsuit. The lawsuit would be for violation of corporate policies and creating a hostile work environment. Also, if the CEO tries to retaliate by firing the CIO, the lawsuit will commence will all due haste. Of course, be sure you have concrete evidence first and documented that he has been warned.

I would think that any CEO would back down to avoid embarassment of a lawsuit over such a thing.

The more I read these posts, the more the thought solidifies that we can no nothing against a god.
If god wants to rape you and make you clean up the mess, then so be it.

I REFUSE to listen to some of you guys that say you can't do nothing.
Some of you talk about being submissive; know your role and stay there.
My job is simple, I execute it everyday and NO ONE is above company policy.
When you start to enact that thought of, "Well, he's the guy that pays my check, so oh well", you lose.
Business is a game of chest.
If you can't do it nicely, then you find other ways to accomplish your missions.
Isn't that what our companies tell us?
If you don't have the tools to complete the missions, then you improvise, overcome, and adapt.
We are NOT the ones that have to bend over and grab our ankles saying, "Please sir, may I have another?"
We are the workers behind the scenes, and no one shall prevent us from completing our mission.
And there are some of ya'll that are going to say, "See, it's because of people like you that dictators are formed, and with that thought, you?re going to overstep your boundaries."
We have strict guidelines to our position, so don't give me this Gestapo crap.
You stay within those parameters and execute them flawlessly.

And for those who are "afraid" of getting fired, then I say unto you, STOP BREATHING MY AIR!
If you are that afraid to do what you're assigned to do, then you don't deserve to be there at all.
You live down the path of no regrets, and do your job.

I had a very similar situation with the CEO of a client company. Our solution was to provide him with a separate broad-band hook-up and a laptop that was used only for accessing and downloading subjects that satisfied his purient interests.

You can do something, you make a complaint. First, tell him straight out you're offended. The law is on your side. Once you tell him, it offends you and it's against *his* company policy, log and date that conversation.

Then every other time you have to deal with this, log it. If you get fired, you make your claim the the EEOC. If you don't get fired and his habits don't change, file a claim with EEOC.

Most of society has agreed that porn does not belong in the workplace. He's wrong, he's not God and you can do something about it.

Do your research. You cannot stop him, but the Federal Goverment via the EEOC can. Would he rather keep that stuff out of the workplace, or have his family name smeared all over the local newspapers?

Block what you can, do your job as ethically as you can so you can look your self in the mirror or sleep at night. If you get fired, take your good experience elsewhere. You will get another job and probably a better one.

http://www.novaforum.com/legaldirectory/labouremploymentlaw/sexual_harassment_in_the_workpla.htm

http://news.zdnet.com/2100-1009_22-995658.html

http://www.allbusiness.com/articles/content/article.asp?ID=748&CenterID=35&CatID=1789

Good luck!

1) Move his profile information (desktop, registry, other settings) and data to a network drive. (Keep profile info separate from data)
2) Remove all data from his local machine except the operating system and application executables
3) Give him a user account on the local machine and remove admin access to his own machine. Give him read-only access to local drives. (Except, possibly a temp directory, but make sure it is deleted after every logoff.)
4) Limit his access to his profile information to setting wallpaper and changing skins.
5) Install software that automatically checks network and local drives for viruses, and keep signature files up to date. (Quaranteen infected files)
6) Keep backups of all profile information and data on network drives.
7) Regularly check audit logs and report abuses
8) Implement e-mail filters that check for viruses and spam.
9) Track patches and keep all software up to date. Implement a system for automatically updating workstation software.
10) Keep firewall rules and filters up to date.

I know drunks who would love to stop drinking when in their right minds, but who lose commitment as they pass a bar.

If the CEO's promises to stop are a mere "get out of my office" then other suggestions here may be appropriate. I especially like the idea of a second computer isolated from the system. He's a big boy, and if those are the choices he's embracing he will certainly reap the consequences quite apart from anything you or HR could do to him. It isn't your job to parent him, police him or counsel him. And any concerns about your enabling him are moot - you are already doing so with the access he has.

BUT if his promises to stop are heartfelt, one way to assist him might be to subscribe him to a service like I saw advertised on www.promisekeepers.com (or perhaps the Focus on the Family website). I believe it puts a small program on your computer which sends a note to their site listing the web sites one visits as they are opened, and once a month (or week?) they email the list to someone else you specify (like one's wife, pastor, or boss). You could automate something like this using your existing logging software, I would assume, and even suppress known "OK sites" or ones which might somehow give away company secrets if SOMEONE ELSE KNEW.

If the struggling addict knows that wifey will be getting the list of sites he visits, it might give him a bit more resolve when temptation strikes. And it fosters personal responsibility - it isn't a battle to try and beat NetNanny, but rather it helps a fellow ask "do I really want to be doing this - especially if my wife will know?"

He's proven that his promises won't be kept the way things are, and leaving the situation the same and hoping for a different outcome is a fantasy. The setup has to be changed, perhaps with this sort of reporting.

I wouldn't try to manufacture a sexual harrasment issue out of this. That's bad for women.

To me, this is an open and shut case. HR should be notified asap. This guy is going against policy and risking a huge lawsuit to the company. My company has walked several employees out the door for the same kind of stuff.

I have experienced this myself. You have several choices:

A) Let him keep doing it. The next time his machine is infected WIPE the drive and tell him that he had a bad worm (due to his surfing habits)and you were unable to salvage anything. If he doesn't keep any data locally on the PC this won't be very effective, but if he does this will be highly effective and satisfying.

B) Lock down his machine.

C) Contact HR. This dum*as* has to be violating his own policy.

I have experienced this myself. You have several choices:

A) Let him keep doing it. The next time his machine is infected WIPE the drive and tell him that he had a bad worm (due to his surfing habits)and you were unable to salvage anything. If he doesn't keep any data locally on the PC this won't be very effective, but if he does this will be highly effective and satisfying.

B) Lock down his machine.

C) Contact HR. This dum*as* has to be violating his own policy.

I have experienced this myself. You have several choices:

A) Let him keep doing it. The next time his machine is infected WIPE the drive and tell him that he had a bad worm (due to his surfing habits)and you were unable to salvage anything. If he doesn't keep any data locally on the PC this won't be very effective, but if he does this will be highly effective and satisfying.

B) Lock down his machine.

C) Contact HR. This dum*as* has to be violating his own policy.

The CEO should be fired. An example to other employees that no one is can violate the policy. He is a liability to the company on many levels.

If another employee is fired violating the company policy, it shows preferred treatment, the company would lose in court.

A sexual harassment case against the company and himself (the company knows this is going on and is allowing it to happen). The company could be held responsible in a court case.

HR is there to protect the company. Collect the evidence and facts of why this isn't allowed and refer the matter to HR. You might want to get a letter from the company laywer as well.

IT does have the ability to disallow access to the internet completely. He abuses the use, violates policy, remove access (this goes for any employee). Even access to the sites that are required him to succeed at his job. Let him fail at his job and get fired for incompetence.

Your CEO is going to bring down your company if he has time to surf for and download porn. Obviously he is sick and needs help but you have no control over that. You do however, have control over what you or your staff are exposed to on the job. Repeated exposure to the pornography creates a hostile work environment not only for you but your staff. Make sure you cover yourself by documenting all requests to the CEO, CIO, and HR that this activity needs to be stopped. HR should be able to help you with your concerns about workplace law. You may find yourself in litigation if anyone files charges with the EEOC and it could look like you didn't respond to their complaints if this is not reported and documented. Is he saving this stuff on the servers and does it get backed up? Also, if the CEO decides you are raining on his parade by complaining and fires you (which happens) you have recourse for his retaliation. Wake up and read the news. Porn at work is a no no -- no matter who you are. Unless it is government. These offices are exempt from EEOC, but are starting to respond to porn complaints by terminating violators. Do some research yourself on what your rights and responsibilites are on the EEOC web site and contact your HR manager.

Look at the article in the National Law Journal: http://www.law.com/jsp/nlj/PubArticleNLJ.jsp?id=1063212018621

Or this one on not taking action: http://www.stltoday.com/stltoday/news/stories.nsf/stlouiscitycounty/story/01DEEC0FEF2ED85686256F5D0018920F?OpenDocument&Headline=St.+Louis+County+roads+chief+quits+

I am speaking from experience here and know how frustrating this can be. Everyone has an opinion, but cover yourself so that it doesn't come down to a judges decision that leaves you out in the cold.

Your CEO is going to bring down your company if he has time to surf for and download porn. Obviously he is sick and needs help but you have no control over that. You do however, have control over what you or your staff are exposed to on the job. Repeated exposure to the pornography creates a hostile work environment not only for you but your staff. Make sure you cover yourself by documenting all requests to the CEO, CIO, and HR that this activity needs to be stopped. HR should be able to help you with your concerns about workplace law. You may find yourself in litigation if anyone files charges with the EEOC and it could look like you didn't respond to their complaints if this is not reported and documented. Is he saving this stuff on the servers and does it get backed up? Also, if the CEO decides you are raining on his parade by complaining and fires you (which happens) you have recourse for his retaliation. Wake up and read the news. Porn at work is a no no -- no matter who you are. Unless it is government. These offices are exempt from EEOC, but are starting to respond to porn complaints by terminating violators. Do some research yourself on what your rights and responsibilites are on the EEOC web site and contact your HR manager.

Look at the article in the National Law Journal: http://www.law.com/jsp/nlj/PubArticleNLJ.jsp?id=1063212018621

Or this one on not taking action: http://www.stltoday.com/stltoday/news/stories.nsf/stlouiscitycounty/story/01DEEC0FEF2ED85686256F5D0018920F?OpenDocument&Headline=St.+Louis+County+roads+chief+quits+

I am speaking from experience here and know how frustrating this can be. Everyone has an opinion, but cover yourself so that it doesn't come down to a judges decision that leaves you out in the cold.

If you are the IT Manager and you work for the CIO.....it sounds to me like the CIO has a serious problem to deal with....and its not your problem.

In the last 10years of IT support I've run into this a number of times and it is very hard to do anything about when it comes from the top down. When working with employees and I ran across porn, I'd simply state that they need to be careful, that its addicting and can be very career limiting move if found by one of the other employees and reported.

But I'd also temper it with humor and confidentiality as I feel that my position requires that users be able to trust me. I've never busted anyone for porn, and have even had employees tell me it was their boss that shared it with them. One company I worked for, I scanned public servers and autodeleted MPG's on a weekly basis. Nothing said, but the point came across. Attempting to bust your CEO for being male, weak and affected by porn is a really bad idea.

However, I protest against the other extreme that has been stated here as well. There are lots of things you CAN do about this but many step outside of the role you are paid for and may require a higher moral standard and showing leadership skills on your part. Stepping to the dark side of the IT force is only going to get your fired and have worse effects on you morally. Why not take up the challenge and try one of these options:
1) If he's up for the challenge, install Cyberpatrol on his machine without letting him know the password to shut it off and see if he can break past its porn blockers. Do it as a "We're just trying out some solutions" and then let him have at it. I haven't been able to get around it.
2) Gain victory by admitting defeat. Give him the victory by admitting that he got past your filters! "Wow, Good job, you got to the Gay porn sites despite our best efforts." Then ask if this is something he'd like you to spend a week to a month improving cause we all know its impossible to find and block EVERY site, or if a change in policy is in order since this is apparently an ok thing for employees to do. (You might want to word it better). Sometimes the less you say, the more in understood. The ethics of a company come from the top down. If he doesn't care, then...
3) The next time he gets a virus, let him know that 'Yea we've seen this one before, lots of people have been getting it. It was ripping through development, source code servers and the HR servers last week. We're not sure if anything was stolen or hacked, hope not!' Don't mention it came from him, let him connect the dots. Mention the costs in time and effort to IT and the rest of the company. Maybe how some major project wasn't completed. He'll listen to that. Even if his boss is daddy, Daddy not going to like it if the company takes a hit because of something stupid like this.
4) Finally, you can just admit this is the way things are and let it go. Trust that this guy's not an idiot, that your CIO hasn't attacked him over it for a good reason and move on to other items. Some battles you can win, others you loose, most arn't battles at all. If its your holy quest to remove all porn from civilization, consider a career move to any major church or a number of conseling centers.

That's what I'd do.
-Rob

By law the CEO is responsible for his actions as well as those of his subordinates.

Viewing porn on company time with company resources is more than just social and moral issues ... it is a form of corporate exploitation and a violation of criminal laws.

A written policy on corporate web use is an important tool is resolving this issue. When the Board of Directors signs off on the policy it must include ALL employees, including the CEO.

Violators should be counseled, and continued violations should be grounds for termination and possible prosecution in criminal courts.

The key is to have a good corporate policy in place.

You are dealing with more then a user who is not willing to abide by the security policy of the company. The CEO of a mid-sized company in many cases is, or has the mental picture that they are the owner of the company and therefore feel it is their right to do with the assets of the company whatever they choose. Someone with this mental or physical position can causes issues in many aspects of the company. The fact that this individual has chosen to ?spend his free time trying to go to porn sites ? at which point he downloads images and movies and viruses? goes to a deeper issue here. Plus the fact that your ?CIO, has spoken to the CEO about this a couple of times, explaining to him the real dangers to the company of his behavior.? Then ?He always promises to stop, but never does? speaks volumes to what Behavioral Researchers have found. The habit of Viewing Pornography is an addiction that needs to be addressed. This is not a technological issue as much as it is a sociological issue that should be address by the board of directors of the company.

First, what he is doing is a waste of time and just as damaging to him as it is the company. However, if he owns the company, he can do what he wants. Surfing porn is not a criminal offense, although it is offensive to some. If done in the privacy of his own office where nobody else can see, it is his own business. Remember who is signing the paycheck. You do have the option of looking for another job?

This problem could just as well happen with IT personnel. Who watches their activities? If he can beat the system I am sure the IT staff can as well. And they know how to cover their tracks. IT people are no more ethical than anyone else just because they have technical skills.

A former employer of mine would send out memos to the employees regarding abuse of the Internet and e-mail. The IT people and upper management abused it as much as anyone else.

The main issue in this situation is the viruses. They can be contracted from any type of Website. Employees should be cautioned about Web browsing on un-trusted sites. If he chooses to ignore your warnings, he pays you, so do you job and remove the viruses. You do have updated virus software?

I haven't read all the responses but the folks who keep saying "document" the activities have missed one - time (person hours) spent on cleaning the network, if in fact it is getting contaminated as a result of the CEOs activities. Include the time that other workers are prevented from performing productive work while the repairs happen. This is one of the only actual expenses incurred that can be directly documented. That is until the "hostile workplace" suit arrives.

If it is your job to maintain the porn filter and it is company policy to prevent all similar activity, remeber it is never a completed project as the porn purveyors continue to change their coloration just as the spammers do. Or was the effectiveness of the porn filter oversold?

Finally, if the viruses collected by the CEO are overwhelming your network, please look at some the network based virus checkers including some of the smaller foreign based independent providers.

The problem with filing a sexual harrassment lawsuit is that it not only effects the induvidual, but also the company. Depending on the size of the company, the financial ruling against them could literally ruin the company. Then everybody is out of a job.

What needs to happen is to have employees file "formal complaints" rather than lawsuits. These complaints can be used as a final warning, or even as grounds for dismissal. No department of labor would side with the person being fired if their actions are detrimental to the future of the company, or if their actions are illegal.

I think the real issue here is the CEO want to show how "smart" he is by beating the IT Department and the web filtering software. Unless he is accessing child porn (which should be reported to law enforcement immediately), the specific content he views is not the real issue (or should not be). Yes, it is a waste of corporate resources but I'm sure lots of other people surf to eBay or other sites that are not "work related". However, putting the company at risk through viruses, worms, trojans, etc. is the issue that must be dealt with. Document each occurrence; I would probably hire an attorney right away and involve him or her in what types of documentation I need. Then in the event you are fired, you will have documentation that was provided to an attorney prior to your termination.

Not to make you a social worker but go to this web-site. http://www.newlife.com/resources/
Slip him this ten step program which can .

10 Steps to Overcoming Pornography Addiction

By Steve Arterburn
1. First, you must acknowledge the addiction exists. Many who are caught in the trap of addiction will adamantly deny the problem. He who conceals his transgressions will not prosper, but he who confesses and forsakes them will find compassion. - Proverbs 28:13

2. You must recognize that what you are doing is wrong. Addicts find a way to justify their problem in their mind. For all that is in the world, the lust of the flesh and the lust of the eyes and the boastful pride of life, is not from the Father, but is from the world. - I John 2:16

3. You must not blame others - "If my wife/husband were just more affectionate." ... "If women/men were not so seductive." Adam blamed Eve and she blamed the serpent. Instead, you must begin to take responsibility for your actions.

4. Make yourself accountable to a spiritual authority, perhaps a pastor or mature believer. Everybody needs a "safe" person to share their struggles with. Therefore, confess your sins to one another and pray for one another, so that you may be healed. The effective prayer of a righteous man can accomplish much. - James 5:16

5. You must recognize that "will power" is not the answer. At a weak moment, your "will" may fail you. By admitting that you are in need of God's help, you open access to His supernatural intervention in your life. You must yield your will to God's will. That's when He can begin a new work in your life.

6. Study the Word of God concerning sexual purity. Therefore putting aside all filthiness and all that remains of wickedness, in humility receive the Word implanted, which is able to save your souls. - James 1:21

7. You must destroy any pornography in your possession. You can't wean yourself off pornography. Think of the hidden pornography in your home as a ticking time bomb that will ultimately destroy your family.

8. You must learn to flee temptation. Self-deception may enter when you think you can play with fire without getting burned. Do not enter the path of the wicked, and do not proceed in the way of evil men. Avoid it, do not pass by it. Turn away from it and pass on. - Proverbs 4:14,15

9. Give yourself time to work through the process of recovery. More often than not, God chooses to take us through a learning and growing process, that can be very painful. Victory over addiction should be viewed as a marathon, not a sprint.

10. It's clich?, but you must approach your addiction one day at a time. Look for little victories and rejoice in the progress you're making. Recovery is a cinch by the inch, but a trial by the mile.

This idea sounds unlikely to work. Most CEO's are fast movers and have very little tolerance for something they percieve as a hinderance to productivity. I seriously doubt you could accurately compile a list of all the acceptable sites he would ever want to go to. Getting threw to a porn site is bad, but it doesn't really reflect on you other than your filter isn't as tight as it should be. But once he starts failing to get to legitimate sites on a regular basis(especially if he's the only one) then it is soley reflected on you and will change their opinion of your performance whether your decision was justified or not.

Not the route I would take.

Mike

Use corporate email to document the actions of the CEO and his responses to your suggestions and requests. Once you have advised your CEO of the severity of his actions, leave the decision making to him. When IT hits the fan, and the investigators come questioning you, you will have numerous emails to the CEO that conclude by saying, "You have been technically advised. What is your decision.?"

I'm dealing with some of these issues now. There's a level of employees(peon's if you will) that are replacable and the company in general will try and spend as little money as possible to keep them happy. then you have your cheif exectutives that are generally showed with gifts, kick backs, bonuses, and "fringe benefits", not to mention a healthy paycheck. When you on on that latter level you have a certain level of freedom.

There's a difference between policy and reality. Porn might be against the policy, but the reality is you don't want to take on the CEO. he didn't get to that position for no reason. Generally shrewd people that aren't going to take too much grief from a network admin.

If your job is to insure your network is secure and smooth running machine, then make that your focus. View this CEO's activities not as a violation, but rather a challenge.

Mike

If the CEO thinks it is fun then take the challenge to him. See if you can shutdown his activities by blocking his access, locking down the permissions on his computer, and purchase better software because the one you are currently using is not working.

The end result, an additional line in your resume that states, "Expert in Internet Security"

"Dad" is in business for profit. If junior keeps crashing the network, it cost the organization time, resources, and (most of all) MONEY!

Then again, if junior is the spoiled rich-kid he appears to be, you may want to consider looking for another position elsewhere; one that does not tolerate the antics of spoiled family members.

Sideline: For some of the responses I've read, ignoring a problem will only compound the situation. You must remain professional at all cost and do not compromise your integrity! If anyone is "let go" because they do not "fit in" (substitute - look the other way), then you will have grounds for legal action. Either way, beware and always be prepared.

Only allow him to acces the intranet and sites on a name only basis. Anything else will redirect to disney.com.Or you can let him eat his own problems and let his stupidity destroy his own company. Or the best idea would be to block any file except htm, html, and aspx/asp. images, video and files are explicitly blocked by the filter to his machine.

then just filter everything through a DMZ back to the original
network where necesary to connect to data & DB servers;
otherwise web apps go on unimpeded & your primary network is
in the clear.

Send a female employee in to see him when he is surfing or to service his computer. Then after catching him in the act, let her run to HR screaming "sexual harassment" and I'll bet that will fix him!

I was going to make the same suggestion. Assuming he owns the company this is the ideal solution. Glad to see political correctness stops at the border.

It could be worse... Like a former client of mine, he could take the company database home to work on and bring it back the next day with his work undocumented.

Talk about job security!!!!

Anyhow, there are lots of folks here who need to lighten up a bit.

Happy days!

Aside from all of the filtering you're putting on the network applicances you need to keep an eye on the specific content of the porn he's downloading... but do it remotely.

Looking at porn is legal, UNLESS it is child porn -- in which case you call the local police and report him. His goose is then cooked.

Imagine the look of surprise on his face when the blue suits show up and haul his perverted behind out in handcuffs.

You could then add a little more heat by producing documentation you've kept on everything you've done to thwart such activities including dates. It will be clear that he's not just "trying to defeat the software."

And do you kill flies with atomic weapons too?? Do you really understand the implications of what can happen to rest of the fella's life should this "suggestion" proceed? Sure, he's got a problem, but don't you think you should explore other....softer options before proceeding to ruin the rest of his life?? How about finding his motivations for the behaviour, before blowing him away???
From one who knows.

The CEO ownes the darn place! He can run through his office naked if he or she choses. And their is nothing the subordinates can do about it. Thats the way its is- even CEO president Clinton proved this fact very well. The CEO can break whatever rules he/she choses thats why they are the boss

Simply putting this issue to the company shareholders should either embarrass the CEO enough to have him knock it off, or the shareholders may replace him with someone with a little more common sense.

In a Government department, scandal would break out in the press here in Australia. "Waste of money and position if this CEO..." - One slip to the media and you'll hear about it for weeks on the radio etc - so that should be enough response if the CEO thinks they can get away with stuff we employees not supposed to do at work. What about their computer setups at home which comes under the Government account?

Private Sector CEO can ride a Harley through his building and put up a Plasma TV to watch etc, if he owns the place - what can you do? In this case I would give him a dedicated service away from the main so others can't hack, see, find anything that will trouble other people - just make sure he/she doesn't lend the laptop who knows what to look for in time of blackmail or "give reason to bring the CEO down" to the board or whatever...

How would the CEO be able to access porn on the web if the laptop isn't part of the backbone?

Hi dudes , had same problem in previouse co. In the end had to to use his IE cached website visited list to use as evidence to the chairman. Within a week he was history. My view goes like this, everyone knows its a no no to surf these sites . If you were just a footsoldier in the organisation , i guess its quite a trivial issue. Bit if you are the head hancho who sets the pace/policy/ethics of the co. then it has to be clear to all. Cos such "top-execs" will set the standard if not to the rest to the IT folks themselves.

Send a link from another email address to the CEO directly to this discussion...:)

...the CEO will want to know the reason for the sudden restriction on his web access. Since he knows enough to "work around" the filters in the first place, it may be a little sticky for your net admins to have a credible explanation.

In reality, these actions by this person in charge display a tactless business environment. I feel for you in dealing with this individual. I suppose if he is into this, imagine what his admin staff goes through on a daily basis in dealing with this a$$.

I propose hardening the workstation policies to the max. Setup IE zones, lock everything down! Do not leave any stone unturned. There needs to be a way to especially make it difficult for [him] specifically-to restrict the hell out of the WWW
via policy or GPO pushes, whatever.

In the meantime, if you can get ahold of GFI LANguard Network Security Scanner and run it against his assigned box(s) periodically. This app will reveal good info. Make the case in documentation! Keep pushing the issue while not making a CLM - career limiting move in the process.

Good luck.

I don't know what is the hirarchy in your company, but thi may work if your CEO has a boss above him.
A friend of mine had the same problem and he told the CEO that this activity is monitored and can be viewd by everybody, and the IT policy allows the CEO's boss to have access to this information.

IT has worked in this case

There it is! (once again, Oz, you have good eyesight). What do all these these self-righteous types do for entertainment when they can't find anyone who doesn't agree with their narrow view of the world?
They should wake up and smell the plastic roses. Money talks, BS walks.

Any CEO that is intentionally circumventing company IT security to "test" the IT department is not a CEO that should keep his job. While it's possible (remotely) that this is really what he's doing, he should be aware that doing so puts the entire network infrastructure of the corporation at risk. That is the next best thing to industrial sabotage.

There's no excuse for the network admin team to fail to do their jobs, though. System maintenance needs to be maintained as scrupulously as possible, all vulnerabilities and breaches documented, and higher-ups in direct chain of command informed through the proper channels of communication within the company.

Nobody in the IT department should be trying to get the CEO fired, but nobody should be covering up for him either. The key here is to do your job to the best of your ability. You can inform the CEO of network security policy, but it's not an IT manager's job to handle discipline for any other non-IT personnel who break the rules. Why would the CEO be subject to IT's attempts at maintaining discipline?

There are proper channels for such things. Pass it up the line. Keep the immediate supervisor updated. Eventually, it will get to someone whose job it is to present this information to someone over the CEO's head (chairman, owner, et cetera). That's all there is to it.

I agree with a couple of good people here who've said you just need to block the bad sites. If I were you I would consider his continues success in watching bad sites as an indicator that I am not doing a good job implementing the policy. Do your job and use his activity as a litmus to your success.

It is a BAD IDEA to consider suggestions like report him to shareholders, etc.. this is dangerous because I can assure you shareholders will care less what the CEO does on his computer provided it does not affect profitability of the company.

Take him as your security challenge. When he cant get any more sites then you've won. Good luck

Don't get confused on what my first post was talking about. You are right ethically and morally it makes no difference if the company is public or private. And wonderful about information HR and wonderful about EEOC and all that related "legal" stuff that can happen if someone is terminated for telling the CEO he can't surf porn.

Now enter REAL LIFE in a small business, privately owned company in anytown, USA....

Keep the paper trail, to save your own neck at least for your own self-respect if nothing else. However you inform the CEO, email, talking through your direct higher up, talking to HR...that only does good if they aren't scared to death of the CEO to begin with. The CEO's at some places are the dictator, and the chances are even other executives who are very close to his "rank" won't go against the CEO.

What are you going to do report to the EEOC on your own merit? Ok, so a multimillion dollar company with tons of "yes" men on the side of the CEO (right or wrong) will be AGAINST YOU, and the EEOC will only have your word to go on.

Now if the ceo is a complete moron and exposes more than just himself to the porn he surfs then you have a much stronger case, if he only surfs porn behind a closed door in his office -- alone all the time there's next to nothing beyond you doing your due diligence in reporting, warning and documenting the incident for yourself and to your direct boss and the HR director.

The picture you paint is assuming you are working with complete professionals and persons who have the "guts" to fight against the CEO with you as the IT person. Sadly, this is NOT often the case.

You'd be very surprised (with the view you posted) how complacent most executives will be with this stuff...so many times its only something EXTREMELY major that will even get a rise out of these people. After all, they view the CEO as the reason they have the six figure income, the fancy house, the fancy cars and their vacations to Cancun twice a year.

No if you are in a situation like this its best to protect your back, notify HR your boss and at least warn the CEO in a written form and then search for another job if nothing is done to it.

Right on Bree! Couldn't have said it better myself. I wonder if some of the guys like Garham even truly work in IT? Such nieve comments. There's the way the world should work and the way it really does. Try and go over a profitable CEO's head and you'll quickly see the difference.

Mike

Remember what he is most likely doing after he downloads his porn. Does he wash his hands before he shuts the site down? Probably not.

What will that say the next time you or your staff work on his system if you stop and put on rubber gloves first?

I had to step outside I was laughing so hard after reading that one!

Did you mean to say that it wasn't the butler polishing the teapor, but the CEO in the board room with a hankie?

Sorry it was just too much to resist!

Did you mean to say that it wasn't the butler polishing the teapot, but the CEO in the board room with a hankie?

Sorry it was just too much to resist!

Make sure the virus protection on his machine is up to date and remove administrative rights so he does not pose a threat to the rest of the system.

It would probably also help things to get him Firefox as a browser, and see if you can get him to use that instead of IE. That'd cut down on the danger to the network that he represents.

It the CEO is getting around your defenses, then you are not doing your job. Your virus protection, firewall and workstation policies are lacking. My next question would be how good are your external security and keeping the hackers out. Fix the perimiter defenses, install an appliance the checks all traffic for viruses. Install network virus protection, keep the definitions up to date.
Make sure the firewall is maintained and updated with patches and rules as new threats appear. Lock down the workstations. As the IT Manager your resposibility is to have the talent avaiable to resolve the techincal issues, whether the talent is internal or external, it is your responsibility to see the job gets done.

Introduce your CEO to the former CEO of the Bank of Ireland. He was sacked for visiting porn sites.

I had a very similar problem with the CIO and he was untouchable. The cure was to setup a single machine that was originally for the employees that wanted to play games and it evolved into a
porn machine. All of the machines on the network were blocked except that one. It even gives us a sort of early warning on new viruses, worms and popups. Kind of like a test bed to try new software on and determine a plan of attack in the event that our network does get penetrated.

nudity, sexuality, and pornography all have to be considered in a work place. shouldn't this be a place for netnanny or some other filtering software site? what if I choose to look at nude bronze figures on the web? could it be considered pornographic if you add a 3rd person?

Really... Why do you care if he watches porn on his PC?

If he's not doing his real job because he wastes too much time - then you have a business reason to act.
If he's watching porn where people who don't like it can see - then you have a legal reason to act.
If you resent him breaking the rules even though nobody who doesn't like porn can see it, and he still does his job - then what's the big deal?

Unless there's a BUSINESS reason to stop him, all you have are LEGAL reasons. So, keep your paperwork & if there's trouble then you have yourself covered. Make sure the CEO knows that you have it documented.

Every IT professional I've ever met knows that porn sites represent one of the biggest threats to Windows computers that exists. More trojans, spyware, and adware ends up on Windows machines due to porn sites downloading the crap to them than any other single cause.

Surfing porn sites from within the business network is a BAD IDEA.

Get him a second PC with it's own dial-up connection and let him surf to his hearts content. As long as he is not connected to your network, he can't expose you to the security risks. And you won't have to deal with a constant stream of his viruses either. He might be offended, but if you put it to him in a sincere, we really do have a problem here atitude, maybe he will be shamed into stopping. And at the very least with his own private line he won't cause you any more problems. I originally thought about this as an amusing response to your problem, but the more I think about it, if you can get it done, the problem will be gone forever. Of course it never needs to be said or known what he is using his second computer for. You will have to make up some reasonable sounding purpose for his having it. Maybe giving him freedom of movement while he surfs the internet because he is the boss and he shouldn't have to be restricted by the companies access control lists or whatever. If you think this is a rediculous idea, it does sound pretty funny, but some version of it might work.

As IT Manager your are responsible for all of Company Management Information Systems. These inclued the challege of Web sites. Therefore you need two things to keep this to happen.

First, you will have to make a company letter and have posted in each employee files of understanding for web is for "COMPANY USE ONLY" and not for personal use, have each employe to signed and dated. Violation to this matter will be company santions, inclusive remove of his/her password form the net and web sites. Post warning labbel to the web filter, Company main Screen and Everytime someone try to sign in. (NOTE: Talking to a member of the Company trustes or shareholders, about a Topic: "What if someone from Management do... to these what they will say in regard off.

Second, a log in date/time of the offece to keep track. After all you can recommend to revoke his authorization from use the company internet services by block this computer from all IT services. If he scream, then you have him/her in what we call cry CEO..... Let it have it.

Sincerely yours,

JV

villalbaj78@yahoo.com