I have a contractor using it at one of the domains I act as ISP for. The first time I saw Snort alert I went ballistic

I know which machine it is being used from and when the contact occurs. It's really no different from allowing the contractor to sit at the box since the connection needs to be made from the eventual host first, they can't just drill in from the outside.