Guess what? Last millennium's authoritarian/totalitarian IT enterprise culture approach to innovation imports can't work. Declaring war on external technologies turns your employees into innovation insurgents and "Google guerrillas". You are defining them as enemies, and enemies have little interest in cooperation and collaboration. No - they're interested in figuring out workarounds and countermeasures.

They're not doing this out of spite; they're doing it because using these tools and technologies makes their work lives easier, better and more productive. Do employees occasionally and, yes, inappropriately use these sites and technologies for personal use - booking travel, buying products, sending personal messages? Of course. Then again, they're also doing work at home and during personal time while on the road. Does IT really want to be Big Brother, Supernanny and Techno-enforcer all in one? As the CIO, is that the "employee empowerment" brand you want for IT?

Enormous reservoirs of time, money, resources and hostility are consumed in this losing battle to define what employees cannot or should not use. Don't do it. People will use IM whether you like it or not. People will use their mobile phones to access proprietary databases. The core concern is that some of these behaviours are far riskier than others. IT's traditional role of identifying such risks in order to eliminate them is no longer sustainable - not when the quality of external options is so often superior to the quality of internal service.

There is no cost-effective "solution" to this challenge; there is, however, a constructive approach. Don't compete; don't combat; co-opt. Organize advisory groups of employees who flout your rules on external innovation and relentlessly get their input on how helpful you should be. The purpose is not to cater to their whims or get them to like you better. It's to exchange ideas and insights around risk. It is not your job to eliminate risk; it's your job to manage it.

You and your folks (should) know way more about the technical risks of these technologies than your employees. How well do you communicate and explain risk scenarios? To what extent do your employees appreciate that there are often very simple, easy things they can do to dramatically reduce their individual and your institutional exposure to risk?

It's foolish and counterproductive to let IT's and Legal's "eliminationist" policies get in the way of good risk management. And it undermines relations with employees when you introduce new systems and services.

How well CIOs and IT should leverage external innovation to amplify core IT processes deserves future discussion. But for now, CIOs need to turn their shops away from declaring war on their digital subversives and instead invite them to better understand the nature of enterprise risk. These people are using these technologies because they're smart, not because they're stupid. They're smart enough to understand the difference between risk elimination and risk management too.

Michael Schrage (schrage@media.mit.edu) is co-director of the MIT Media Lab's eMarkets Initiative