Corporate Security Rules Rocked as MP3 Files Roll

Computerworld - We recently caught and fired an employee who broke our policy against viewing pornographic Web sites at work. I had hoped his example would provide a clear deterrent to future Internet abuses. Instead, those events have stirred up other controversies.
Our Internet and e-mail policy is straightforward. It fits on a single printed page, applies to everyone, warns everyone that they have no expectation of privacy and includes the following eight simple rules:
• Don't look at pornographic, sexist or racist material.
• Don't pirate software or data.
• Don't insult people over the Internet.
• Don't speak on behalf of the company.
• Don't spread viruses.
• Don't hack or possess hacking tools.
• Don't send unprotected information over the Internet.
• If in doubt, ask.
I thought the rules were clear, but in the past few weeks, users have violated these security commandments one by one.
MP3s for Free
The controversy started when someone gave management a "press clipping" about a company that was supposedly sued for running an MP3 jukebox on its network. I've found no evidence that the story is true - like so much information propagated on the Internet, it has no details that could help me track it down. Still, management wanted assurances that it couldn't happen here.
The story I was presented with, thirdhand, was that a group of developers had set up an internal server onto which users could upload and share music in MP3 format. Supposedly, the music industry had found out and was suing the company involved.
We ran a report to identify audio files on our network and found that the average employee was storing 14 music files. More frightening was our discovery that one user had 4,673 files. If music industry lawyers are reading this, I'm sure those files were copyright-compliant home-produced samples, so there's no point in suing us.
Yeah, right. So we're running a job now to delete all such files unless the users can provide proof that they are copyright-compliant. I don't expect that anyone will be able to do so. If they can't convince the lawyers, then the music will be deleted. That way we can appear helpful and fair and the action will have the same effect as an outright ban on MP3 files.
Including our previous adventures with porn surfing, two of our eight rules had been broken. But it got worse. Later that day, we received a request that a user not be monitored for surfing pornographic content, since he was