It seems that much of what's going on in that department is CYA activity, but it seems to me that an internal project or open source project are the most defensible uses of the time.
Instead of sitting there doing nothing, he applied and sharpened his skills in a way that was productive for someone. His first response should be, "Can the company take credit for my time on this open-source project?" and "If this internal project is useful, can I use these skills to make anything else easier in our department?"
The risk is that he'll violate the "don't rock the boat" principle that is the bedrock of CYA. The possible benefit is that if you have two employees, and one is creatively loafing while the other is creatively applying himself or herself, you know which one will offer long-term value (and be easier on a manager, who won't have to constantly nag the person to keep them from screwing off for 40 hours a week).