I'm not sure how you can conclude it doesn't place the network at risk. If you have computer on a secure network, then simultaneously attach it to a non-secure

I'm not sure how you can conclude it doesn't place the network at risk. If you have computer on a secure network, then simultaneously attach it to a non-secure network... well, that's pretty much the definition of a compromised node that can't be trusted any more. You have no way of knowing what kinds of data may be getting leaked in or out based on author's assertion of browsing facebook. For that matter, neither you nor the admins have any way of knowing if the USB device itself is infected. We also don't know the author's competence and ability to use sane judgement. And that's really the point of those kinds of policies. The admins don't know the author's ability to use sane judgement. In some environments this ok (my current job places no such restrictions). In other environments it is not - you wouldn't believe how locked down we were when I worked in financial services. So the rules are designed for lowest common denominator. Of course if you ask any individual if he should be exempted from the rules, he will say yes - of course! And will have a perfectly valid reason. In a similar fashion if you ask any person if he is a good driver, he will also say yes, of course!