CEO surfs porn

Anyone telling you to find ways to enforce this and stop the behavior either has not read the posting well, never been an IT admin, or does not have your best interests in mind.

Your job is not to police the company computers. (IT Nazi)
If you find someone breaking policy then you notify the correct people, bosses of the individual.

After that if they decide not to do anything about it then that means you can do nothing about it.

Protect your network and get on with your life.

I could not take this one seriously due to the subject matter....

I look at is as a challenge, lock down your house and document the conversations you have had re: the CEO with your HR department (IT can sometimes be the scapegoat when something catastrophic happens) good luck!

I look at is as a challenge, lock down your house and document the conversations you have had re: the CEO with your HR department (IT can sometimes be the scapegoat when something catastrophic happens) good luck!

Just kidding...about surfing porn, that is.

Dude! What webfilter and antivirus programs are you using?

I would credit the CEO with bringing to light the huge holes in your implemented security technologies.

Short of the CIO going straight to the President (if this is a different person) or the share holders, don't think there is much to be done.

Perhaps encourage someone to file a lawsuit?

Except of course after talking with a lawyer about company issues in the past....he said more or less the same thing since the company is privately held...one thing though...

why did the lawyer laugh hysterically when we asked him to be on retainer for our company? ;)

First off you sound more bitter than the poster which is seeking the advice...go back to your tea and crumpets, read a book on how to sack your elist snobbish attitude..then resume posting.

Now...the company is NOT public, its private..which means A LOT. Anyone who thinks public verse private doesn't impact the situation is a complete knucklehead (and they should see me about a bridge I wanna unload on the cheap).

First, the issue should be handled between the CIO and the CEO. Second, if the CEO is able to able to circumvent the system, I think the system needs to be looked at. I can understand that filtering software is not 100% which is why the technical staff may be required to make occasional tweeks until the CIO can convince the CEO that he is doing damage to the system and compromising security.

As to the virus part of the equation, the technical staff needs to re-evaluate their policies. The CEO visiting porn sites should not allow viruses into the system. A more aggresive approach to virus protection may be in order.

One last note about the CEO. If there is a board of directors perhaps the CIO can bring the CEO's violation of company policy to their attention and let the pressure come from above if nothing else works.

Yes, but the CIO nor the IT Manager have the authority to fire the CEO.

Excellent response!

If the CEO is the owner you still have options. You can do you due dilligence in trying to get the CEO to conform. If that fails then you have the option of looking for work elsewhere. Ultimately, if you stay and the CEO's behavior continues, by negation you accept that behavior.

Filing a sexual harassment charge is not quite that simple. Firstly, I will assume that the CEO has a private office and if he is caught viewing pornography by a "female" he is tryinig to get caught. Secondly, the females need to at least inform the CEO that they find the material offensive. After informing the CEO that the material is offensive and it continues they must try informal resolution before filing formal sexual harassment charges. Lastly, I'm concerned that you think it has to be a female that does this. Some men find pornography just as offensive as women, and some women are into pornography. I think that your premise is a contributing factor to their being so much inter-gender tension in the work place which often leads to false accusations.

I think all the suggestions you made should be considered by the CEO. If he/she doesn't care about the implications, why should I. This kinder gentler mentality in my opinion is so counter-productive to the ultimate intent.

low key and suttle

I'm not sure why you posted this sort of thing as a response to me, as though you were saying something that contradicted me. We seem to be in agreement, in principle.

Some of your practical suggestions must be evaluated based on the situation, however, and not all may be applicable in this case.

give him a workstation on its own subnet and in the DMZ to be devoted to surfing porn in addition to his business workstation for Christmas.

While your at it, set it up to reimage on reboot and so that he doesn't lose all his porn each time, have it automatically save on an FTP server where he can get his saved stuff at home or on the road. If you post the URL here at TR, some of the pro's here will help ya out making sure it doesn't crash.

I'm not into porn, so I can't help ya there, but if no one at TR wants to help, just start a newsgroup or IRC channel and I'm sure you can find some admins that will.

Hope that helps! :)

Your policy must clearly state the company's position on this matter...in terms of action to be taken when policy is violated

This is something that I've done at other places I have worked at. Start posting on the Intranet a list of new viruses/spam going around that employees should be aware of for potential office impact and also that they should be aware of it for home. After a few weeks of that, add to it a list of viruses that your software has stopped and which ones made it through along with a synopsis of how it got in (i.e. surfing websites). NOTE: you still haven't identified who was doing it or websites (let the employees speculate.) This level has normally worked for me because it makes the employees actively looking to see who's doing it and what sites they go to.

The next step is to start listing the websites that people have gone too (of course, make sure they are blocked before you post this) and add a blank column for the name of offenders or computer name.

I've never had to go further but haven't had a CEO do this to me. Bottom line is CYA document all of the sites visited, when you blocked them to identify that you're doing your job in blocking inappropriate sites as they are identified and the talking you've done with the CIO and CEO to try and get the CEO to stop.

Now for reality, run this by the CIO before you do this because if you've discussed it with the CIO, you've passed it of to him/her. You're there to do a job and the CEO knows it. If you take the CEO down in an public format your job is toast and chances are you'll have a tough time getting a job elsewhere. If you don't like it and you can't get it to stop subtle like, move on to a different job in another company and pray for better.

I can see this working if there's a Board and would use it myself, but if this is a private company, there's probably no board to take it too. I'd be reluctant to take it to the press if it's a smaller privat company as it could cost jobs.

Buy the very best of piss and cum,scat bdsm,animal videos for him.After watching these anything else on the net is too tame and he won't go surfing anymore.Also get one of the secretarys to give him a good blow job at lunch time.Who wants to watch porno when you can have the real thing.
See problem solved.Give us a job(not a blow job)
The boyce

I think this is a good approach in theory. In reality, however when the CEO is not searching porn sites and is trying to run the company, having to call tech support everytime he tries to go to a valid web site can backfire and make the IT staff look bad.

There are quite a few responses here that allude to what disciplinary/punitive action individuals would take to curtail the CEO's activities. I'm curious how many realize where the CEO sits in the chain of command. Discipline doesn't flow from subordinate to senior regardless what wrongs the senior is guilty of. We can adhere to company policy which ultimately the CEO approves and/or report the offenses to our immediate supervisors and let the issue work its way through the system. In this particular instance the real issue is weak systems administration. Someone posted earlier very detailed steps on what actions needed to be taken to lock down the network. That is where the network manager should be directing his energies. Searching porn sites is a moral issue (and a violation of most corporate policies), but it is not illegal.

Now you're placing your employment status in jeopardy. For starters your assuming that the CEO is IT illiterate. What happens when he asked to be briefed by the CIO? Are you condoning purpetuating a lie?

Now we've ventured into the rediculous!

I work in a small company where the CEO is the owner of the company and I report directly to him. Not only does he violate the internet usage policy, but he insists on being a member of the Administrators group on the network. In addition, he hates password rules, demands remote access and generally expects to get what he wants when he wants it.

This is not an uncommon situation. I think you have to deal with it. I added him to the Admin Group and promptly took away all privileges from the group. I force him to conform to the same rules he approves for ordinary users by telling him that I can only unblock his firewall access to unauthorized web sites if I unblock everyones.

Last, but not least, I analyze web usage and report it at Managment meetings once in a while. In addition, I personally scan his computer for viruses daily and let him panic if one is found.

The way I see it, he's the boss and if he want's to waste company time and waste my time cleaning up after him....it's the job. I rarely allow him to bend the rules that apply to everyone on the network and let him know what the consequences of allowing unacceptable use of corporate resources are.....wasting his time might be ok with him, but as soon as he realizes that his employees might also be wasting time - he changes his tune.

I haven't forgotten it. I just know that it's often an irrelevant matter. In American civil court, money talks.

Should any of the porn that he is looking at involve minors, law enforcement would love to hear about this. This is a crime and if convicted the CEO will be classified a sexual prediator. But this will definitly affect the life of the company and your job.

If it's HIS company, and HIS money that pays you, then obviously he can do what he wants with HIS time.

You have to do your best to "protect" the network and computing resources, however, if you have "advised" him about taking risks, and you have pointed out the economic impact of those risks, and you have analyzed and informed him of the potential impact to his WHOLE COMPANY if something gets out of his computer into the network by accident due to his refusal to "play it safe", then all you need to do is simply accept that he is a porn addict, and let him play his own game.

CEO is like the Don in corporate America. He is pretty much untouchable, especially if he is also the chairman/chairwoman. No matter what you are going to be a liability to the company. You have to remember that the CEO's have friends just like you have freinds in the company, but his friendhsip may go way back and they will back the CEO up unconditionally. Why? becasue they can. The likely chance of the CIO and/or the VP of HR calling him on the surfing is slim to none. The laws that protect employees from wrongful termination and such doesn't fly in the U.S. Court room, basically money talks and bullshit walk. Do yourself a favor, just do the best you can there and if it becomes unbearable, www.monster.com

Good Luck and think really hard about putting the CEO in front of the firing squad.

I've been down this road....including stuff more severe than porn which involded outside agencies - so -

Your doing your job. That is, you report your findings to your boss.

Who are we to interpret what is porn & what is not? Who are we to form a legal opinion?

In my case, via many HR requested investigations, I viewed many images, movies etc..which I considered exreme.........I was told (by an expert) that due to the subtle ways in which they where shot........A judge would HAVE TO consider most of them "Artistic impressions"

Incidently, I'm not into "porn".....but I'm not "prudish" either - for what that's worth.

Having made that statement, could you tell me if I would enjoy "Debbie Does Dallas" or what I may consider "porn"?

Please don't answer that, I'm just saying one persons porn is another persons "foreplay"..........(This applies to women too.....I used the word "persons" intentionally.)

In the workplace, this stuff belongs to HR. If there is no HR then follow your chain of command.

Do yourself a favour - Suck it up and realize there are many freaks out there. Most of them hold "high" positions. (laugh)

Seems like your CEO already has a handle on things :-)

At the end of the day ------- None of us are lawyers or the police. We report our findings and remember - NEVER FORM AN OPINION ON WHAT YOU FIND, IT IS NOT YOUR ROLE. Look at it this way -It seems like a challenging environement anyway........you seem to be learning a lot about network security! It's all good.

If, for whatever reason, you feel you should be doing more - Update your resume & shop arround.

If you've talked to him enough about it, then it's time to step over his head and talk to his boss...

There's no excuse, and no one is higher than the law. If the rule is NO, then it's NO!

Mrafrohead

I don't think forwarding to his wife, friends, or anyone else is an option. This is just being malicious and evil. Outside of the workplace this is really no ones business. The CEO hasn't broken any laws and it's not his employees place to police his morality. That's certainly not what they were hired to do. Professionally, the IT manager fulfilled his obligation when he reported it to the CIO. If an employee has such strong feelings about pornography and don't have the technical ability to curtail it (IAW company policy) then perhaps they should look for work elsewhere.

Keep in mind this is the CEO we're talking about. How many employees will actually see him in his work environment? It's not as if they lounge in his office.

I wouldn't recommend getting (or attempting) to get a bunch of employees to sign anything. This is tantamount to a mutiny and best case demonstrates some lack of loyalty to the company. Ultimately, they're at a greater risk of losing their jobs before any action is taken against him.

There was nothing in the original post to indicate anyone was uncomfortable. The only concerns that were presented is that he was bring viruses into the system. Ultimately the fact that he can continue doing this demonstrates shortcomings in the IT department.

Not only have you gone overboard,you've ventured into criminal activity. Just posting your comments here constitutes a criminal act (conspiracy to commit, promoting illicit activity, etc).

I'm not sure why the CEO's affinity to porn evokes such strong emotional reactions. He hasn't broken any laws and we aren't the moral cops, are we? We need a professional approach to protecting the network and that's it.

The problem with your solution is that when the company starts to lose money, it's much easier for the CEO to replace the employees than it is for them to influence him to stop. I can guarantee you there are people out there lookin for work that can perform their jobs without being concerned about what the CEO is doing in the privacy of his office.

So many responses here allude to the fact that the CEO is the problem. The CEO is not the problem. The system administrator is. If the network were properly secured the CEO wouldn't be able to do the things that have been discussed here.

The have been responses that allude to underminding the CEO's authority or disrespecting his position by isolating him on the network, etc. I recommend anyone that would actually consider such responses think about how long they would last in their respective organizations if they were to follow through.

Ultimately, the fact that the CEO surfs porn sites is no ones business. Anyone who feels so strongly against these activities in my opinion really only have one option... look for employment elsewhere. Most likely the CEO didn't develop the urges to start surfing porn sites by virtue of becoming a CEO. They have most likely had these urges most if not all of their lives. Despite these desires they managed to rise to a position where they directly effect the financial health and public perspective of their organization.

What liabilities are there? There are no laws against surfing porn sites, with the exception of child porn. Since the CEO is doing this from his own computer, I'm assuming he's doing it in the relative privacy of his own office. The only real issue here (and I'm assuming) is that the CEO is violating corporate policy. In reality, the fact that the CEO can do this so readily, it's possible that this company doesn't even have a policy in place. In case they do, the only group with discipline authority over the CEO would be the chairman or the board of directors.

If he or anyone else were to personally witness the CEO surfing porn sites you would be correct, it could constitute sexual harassment (only after the offended person made it clear to the CEO that they were offended). All of your links are nice, but they need to be placed on the proper context. Just because we know someone likes porn is not grounds for a sexual harassment complaint. Just arbitrarily throwing around EEOC because we personally don't agree with something only diminishes the effectiveness of the organization for those that have real complaints.

Some of these responses make me wonder if the posters understand what a CEO is and what their position in the company is.

Perhaps you shouldn't be so quick to insult the intellectual capacity of others. Your solution presumes 1) that there are investors when the company could be privately (family) owned and operated. The original poster never said, and 2) even if there are investors that they care. If the CEO is making hundres of millions of dollars (purely hypothetical since I don't know) for the company and by extention the investors, do you really believe they care what he does with his free time, especially since viewing porn is not illegal? I keep saying this, but, what's one more time... unless he's viewing kiddy porn, the only thing he is guilty of is violating company policy, and someone posted earlier that they don't apply to the CEO. Everyone that is looking for a way to get the CEO fired are merely trying to force their moral values into the CEO's company which they have no business doing.

True! If I came across this situation though, I'd be trying to clean my own house before announcing in a public forum that my network has vulnerabilities.

I do, however, disagree about the dumb question philosophy.

...and that's exactly what many responders here have suggested. It's unlikely the CEO is going to put in a trouble call because he can't reach his favorite porn site.

The CIO has to put his concerns in writing, tactfully. Then live with the problem.

Agreed, it is not his company alone, but he was put in CEO's seat because he is expected to run the company and ideally make/keep the company profitable. Keep in mind that aside from what the law requires, all policies in the company exist because the CEO either directly or through delegation has allowed them to exist. There are no laws that control surfing for port, aside from kiddie porn. You speak as if you have more authority than what you really do. You would turn something off (I'm not aware of any ports or services specific to porn)??? What happens when you're ordered to turn it(?) back on? Do you disobey the order? If you are so morally (since that is the only foundation you can function from) opposed to the CEO (or anyone else) surfing porn sites, your only recourse is to quit. When you take it upon yourself to start making changes to the network most likely you'll be terminated. Professionally it would be much better for you to quit based on your beliefs than to be let go for insubordination. The ideal solution would be to make it so difficult for the CEO to get to the porn sites that he has no choice but to stop. Those working in networking/internetworking must maintain constant vigilance, and this includes reviewing logs, etc, to see where users have attempted or suceeded in visiting unauthorized sites.

Now that sounds like a do-able solution to the problem! There is no insubordination involved, no overstepping boundaries, and the point is made. I think it may be foolproof.

Does one morally wrong act justify another potentially job ending morally wrong act? By downloading gay porn you become guilty of the same thing you're trying to stop the CEO from doing.

Do you honestly believe that he has the authority to "require" the CEO to do anything!??? He is hired labor whereas the CEO is by definition the top officer of the company. Come on people!

Actually, child porn was mentioned a way back, but the original poster didn't mention anything about child porn. Since he is clearly concerned about his CEO surfing porn sites, I would like to believe that he would have enough sense to notify the authorities if child porn were involved, but that's blind faith on my part.

I agree with your approach. What's sad though, is that the CEO as you stated probably doesn't understand technology yet he can still beat the IT guys who supposedly do understand technology.

IE does have security holes, but it's unlikely that switching to firefox will resolve the underlying issue. The network in this case needs to be locked down and the IT team needs to be more vigilant in reviewing logs, etc, to determine where the weaknesses are.

It's common knowledge that IE has security flaws. However, many organizations are more than capable of minimizing the impact of these flaws. Despite all its flaws IE is still widely used effectively in the industry, and many organizations do so without problems. It's unlikely that there is anything that can be done short of taking away internet access of the CEO that will stop him from reaching porn sites, but procedures can be put into place that mitigate any damage that can be done from surfing these sites. Potential spyware, virus', etc, should be trapped and isolated prior to doing any damage to the network.

I think most of the responses that I've read are more focused on the fact that the CEO surfs porn rather than the real issue. Surfing porn sites is only a symptom of the real problem. Taking away the CEO's computer, internet access, or whatever, doesn't change the fact that the network is clearly vulnerable. The IT department should be looking at how they can better secure the network. The company that I work for has 90,000+ employees worldwide. It's unrealistic to think of all those employees there isn't going to be a single individual that does things they aren't supposed to be doing.

Viewing porn is not an addiction, it's a personal choice that reflects character. It's also assumed that those close to him outside of work don't already know that he enjoys porn. I only mention this because one of my co-workers wife is always emailing him pornographic material at work which itself is somewhat bizarre since they live in the same home and she could easily pass it to him when he got home. You've made some good suggestions here that can be effective for those that have a smidgen of a conscious. There have also been some other post here about the sexual harassment aspect of this, which could also be a deterent used by those that are impacted by the CEO viewing porn.

...but, HR doesn't have the authority to fire him. He can only be fired by whomever has the authority to hire him in the first place. In that case they would have to place morality above profit (assuming that the CEO is making them money). As we've seen in the news over the last few years though with companies such as Enron and Worldcom, profit and finalcial gain can be powerful motivators.

Nice post. Addresses the issues as opposed to trying to be a moral compass.

You didn't say what country you live in, but in the U.S. there is nothing criminal about viewing porn unless it's kiddie porn. There is the sexual harassment element, but for that to be true someone has to be offended and make sure the offender knows that they are offended. If no one is offended then there is no problem. The original poster mentioned that porn sites were a source of security issues on his network. He never said anything about being offended by porn. Others have introduced that as a way of curtailing the CEO's porn viewing habits.

Since when should it be a competition to see who can worm there way past network security. The internet guidelines are there for a reason, and in my workplace, even if people cant get past the security feature, the attempted access is logged, and appropriate action is taken against the offender. The CEO is a slight exception, because he can be extremely difficult to discipline (no pun intended). Therefore other action should be taken, maybe finding his favourite porn sites and redirecting to other interesting sites automatically, such as the Salvation Army website, and Pervs anonymous. This tends to work well. Good Luck to you all, and merry Christmas.

I, personally, find people trying to get someone fired for looking at porn to be closed-minded, judgmental, and generally offensive, and I don't even go porn-surfing myself (yes, that's right, I'm in a minority among males). I have no idea what anyone would be getting "revenge" against this CEO for, since it doesn't sound like he's actually doing anything to hurt anyone. The problems here are in the CEO's willful violation of network security standards.

If he can't be convinced to get himself in line, the only thing left to do (short of quitting) is to clean up after him and report to your immediate supervisor. That's life.

Spray contact adhesive all over his chair. Then, when he drops his pants to play with his goat, hia ass will get stuck to the chair!!

Yeah, that's it...

Buy the dude a modem,laptop and doorlock. Problem solved

1/. If the Tugmeister has a web cam try to catch a few "personal moments" and then make the video nasty available to him via popups which he can't get rid of (via an internal website which, to him, looks like it's on the Internet).
You can then suggest a more effective web filtering software.
2/. Let him have all the porn he wants. One day he will get all tugged out and fall asleep at his desk with his hand on his old fella. Eventually someone will walk in and wake him up (maybe a client). He will then re-think his strategy for self-satisfaction.

If you have any desire to move up the ranks, then play the game. One of the most important facets of office politics is knowing how to pick your battles, and when to fight them. Let's say your CEO left the company on bad terms. Do you want to be the one that looked like you booted him out? Chances are, there are lots of others in his group that wouldn't care for you knowing what happened. A good player also let's others fight the battle. You're CIO is aware of the situation, so your ass is covered. Let the CIO go to the mattresses with him....that's why they pay him the big bucks. On that last note....how do you think the CIO got to where he is?

Just have a black list setup and keep an eye on what he is surfing.

Keep in mind: If the CEO can get through your security, others can as well.

You did your job by reporting it to your CIO. It's now in his hands. You're in a tight spot - but given the tight IT job market, what else can you do?

I had to deal with a similar issue with a VP who we allowed full access to the internet because of the blocks he was getting when doing research. Within a day, he was surfing porno websites that had bestiality and amongst other things, borderline kiddie porn.

So I told my boss who went to his boss. They OK'ed my suggestion to make a forensic image of his hard drive late one night to preserve the data. They reviewed the dump of his IE temp cache, logs, etc. Company attorney felt he wasn't violating any laws (guess it's legal to look at 8 yr old Asian girls wearing bikini's made for 5 yr olds and laying in suggestive poses). And it pretty much died right there and we were told to limit his web access and keep an eye on things. It hasn't been a problem since then - but needless-to-say this VP no longer acknowledges me, or even dares to make eye-contact with me. Pervert. I'm tempted to make an anonymous phone call to the police... if he's ballsy enough to do this sorta thing at work knowing that we're watching, I can only imagine what's on his PC at home.

While I agree with most of what you say, as well as the fact that we "peons" don't mess with the brass, I disagree with ou when you say that IT is an expense, not a revenue generator.

Shut down the network, and lets see how much revenue that company generates in a day. For that reason alone, IT is a very important part in the revenue generation property, whether the brass is willing to see it or not.

My ex-ceo also does porno surfing, signing up "FREE SCREENER" etc... the worst is he download porno site passwords is ciculated in office...my god....... He even accused me(IT admin) i did't maintain the mail server properly as he receive spam in mailbox....goosh.........

I suggest give him a copy of warning letter CC to Managing Director & block his internet access over lan.