Does filtering adult Web sites work?

Does software to block adult content and other objectional material really work? In past years, such programs have been knocked for blocking legitimate Web sites along with the nasty ones -- such as screening out breast-cancer information sites along with nubile young vixens.

But the technology has advanced, and software-as-a-service changes the equation, according to some security experts. The House passed a measure earlier this month that, if it makes it into law, will require agencies to have blocking software installed on any systems for which they get appropriated funds, specifically targeting pornography.

The House measure, part of a supplemental spending bill (H.R. 4899), appears to stem from recent cases of employees at several agencies, including the Securities and Exchange Commission and the Minerals Management Service, spending most of their workdays browsing Internet porn rather than monitoring the businesses and industries they were supposed to regulate.

But is the problem really that widespread? Are there really very many people, outside of a few clusters in an agency here and there, dumb enough to look at porn in the office?

Yes, said Alan Paller, director of research at the SANS Institute. While he had no figures specifically relating to the government, he said the phenomenon is "breathtakingly" widespread in the working world.

"People think they're anonymous, even when they're at work," he said. "There's no reason for them to think it, but they think it." In addition to sexual content, he said, many organizations also wish to block employee access to sports sites, streaming media and other time-sucking diversions that some employees can't stay away from.

The problem of software screening out legitimate sites is easily solved, he said. "It doesn't take very long for somebody to get a site that is blocked ublocked," if access is needed, Paller said. "In general the [legitimate] sites people want to go to that are [blocked] are very few and they're used over and over again." It is little effort for an agency to put the filter in place and then deal with exceptions case-by-case, he said.

Software-as-a-service is also an ideal option, he said, as it lets a third-party company deal with maintaining the list of blocked sites and updating them in near-realtime, he said. "This is a place where cloud computing makes a lot of sense," he said.

Others, however, criticized the measure. Jim Lewis, a cybersecurity specialist at the Center for Strategic and International Studies, told NextGov that lawmakers should let agencies determine the best measures for deterring Internet abuse. In many agencies, the likelihood of getting fired is probably deterrent enough, he said.