since most people consider their daily transactions ( FTP , mail , what-have-you ) safe, there is no need to go for anything more even if the IT staff understands the risks, any attempt to actually implement something will cause a stone-throwing for "breaking something that was working just fine" even if the downtime is minimal.

I don't think he's talking about friends - from the OP they sound more than colleagues in the same class...