We do allow our candidates to use the web. We also write the tests specifically for the job at hand. We do NOT penalise for mashing, copying, or even asking for help. What we do penalise is for when someone grabs something and doesn't understand what it is, how it works, and cannot make it 'theirs'.
We also penalise people who copy code from the net and then attempt to pass it off as their own.
We don't monitor the test - we allow the candidate to work against their own clock.
We aren't fearful of hiring wrong people - but we don't have time for them either. We also find it's an extremely good means of filtering out what can be up to 1,000 applications. Those who apply for the job are those who really want to work for us, and are willing to show us their skills.
Our questions tend to be qualitative, which means that it's very hard to 'find the answer on the net'. They will include questions such as (eg for a web designer) - "In what ways could you significantly improve the BBC news website, and why do you think the BBC have not made those improvements already?"
For a (S)CSS engineer, we will be asking questions to demonstrate approaches to carving and presenting a responsive page, based upon a simple flat visual.
For all of these things, there are no right answers, but there are good answers.
The funniest response we once got from a programmer, to about 9 out of 10 of the questions we had on the test for the position he was applying for, was "It's not my department." - needless to say he wasn't shortlisted.