While driving to work the other day, I heard a report about
government employees who had been discovered using the Internet to view
pornography at work. The outraged officials being interviewed yammered on about
how this would be investigated, and they would get to the bottom of it. I shook
my head and turned off the radio. Is Web-filtering software such a secret that
people still don’t know about it?

Perhaps I am in the minority, but I include Web-filtering
software as a must-have application right along with virus protection for
government organizations. Some people argue that it is not our job to filter
the Internet—that we should rely on policies and procedures to prevent misuse
of government property. I strongly disagree. Every time such
a report makes the news
, it is a black eye for government. And I, for one,
think it is our job to help prevent these kinds of harmful stories from
blotting the reputation of our organizations.

Head off embarrassing or litigious incidents

Policies and procedures are good for discipline after the fact, and may deter policy-conscious
workers, but many need protection from themselves. My motto is, if you agree
that some Web sites should be off-limits to employees and are willing to discipline
them for breaking those rules—then don’t let them do it!

Web-filtering software is one way of protecting the
organization’s users from straying into areas that are prohibited by policy
anyway—kind of like an electric fence for the browser. Technically, Web-filtering
software sits on a server on your network and all browser traffic destined for
the Internet is routed to it and compared against a database (refreshed nightly,
by subscription to the database service), which continually updates its list of
restricted Web sites.

Some examples of applications in this category of software
are:

These applications provide a variety of ways of filtering
including white lists, black lists, choosing by category, by particular site,
by keyword, as well as being able to exclude by group membership or individual.
I’ve had experience with Websense and CyberPatrol, and I found them simple to
use, flexible, and easy to implement given my organization’s needs. Most
importantly, it was easy to edit the white lists and black lists; you can add
individual sites to the approved or blocked lists, according to your
organization’s needs.

I think that the most important thing Web-filtering software
provides is limiting legal liability and proving due diligence in the case of
harassment lawsuits. Should an incident occur, I would much rather be in the
position of stating concretely, “We have strong controls in place to
curtail such behavior; it is a clear violation of our policies and procedures;
and the guilty parties will be disciplined,” than some vague dodge about
investigating and “getting to the bottom of it.”

Other benefits of Web filtering

Besides preventing your Web-browsing users to go where they
shouldn’t, all the products above tout additional benefits of filtering. Some
of these are:

  • Increased bandwidth
  • Greater employee productivity
  • Enforcement of acceptable use policies
  • Security
  • Risk management.

All of these benefits are relative depending on what you
choose to filter. Obviously one could be very strict and prevent almost all
browsing that is non–work related, and thus increase bandwidth and
productivity, but at the cost of some good will from the workforce. The IT
governance bodies that I have been a part of when using these products focused
exclusively on content that was strictly forbidden by the acceptable use
policies that were in place. Therefore, the filters were set primarily to block
pornography, hate material, graphic violence, and other forms of obscenity. In
each case, the software was well-received by the organization and there were no
protests over the action.

An important thing to note is that almost all these packages
come with monitoring tools as well as
filtering tools. Please be advised that while employing filtering tools work
well in the realm of open records laws, monitoring tools can land you in a pot
of hot water. Keeping logs of where the organization’s employees are surfing
may strike some as being a little bit too much of a Big Brother tactic. The
monitoring and control tools are seductively powerful, but think hard about
each additional feature that you implement beyond filtering.

Lastly, it really does pain me to hear about Internet misuse
by government employees when we have such relatively cheap and easy ways of
stopping most of it. I may be old-fashioned, but I still believe that an ounce
of prevention is worth a pound of cure. If you aren’t employing some sort of
filtering, please consider it. You
will be glad that you did.

Keep up with the issues and challenges that uniquely affect public-sector IT with TechRepublic’s free Government IT newsletter, delivered each Tuesday. Automatically sign up today!