Sarbanes-Oxley and content filtering

[dougo]

Our company recently installed the Barracuda Spyware Firewall, ostensibly to block spyware and web pop-ups. But as it turns out, it also does content filtering:

Does the Barracuda Spyware Firewall also perform content filtering? How does content filtering work?
Yes, the Barracuda Spyware Firewall uses one of the most extensive databases covering some of the highest risk Web sites on the Internet for its content filtering. Our database is divided into many different categories for easy management and administration. Categories include sites containing offensive material, personal Web sites, Web-based email sites, and other categories that might reduce productivity in the workplace.

I found this out because browsing http://rpg.net/ and http://eblong.com/ result in the following message:

The link you are accessing has been blocked by the Barracuda Spyware Firewall because it contains filtered content, the content belongs to the category of: game-playing

I suppose it's reasonable to consider rpg.net a game-playing site; I go there to read shannon_a's game reviews. But eblong.com is zarf's personal web site; he does have a lot of game-related stuff there, but it seems wrong to ban his entire site: what if we wanted to use Zymb, his Python Jabber library?

Anyway, the overzealousness of content filtering is just one of many reasons why it's obviously stupid (others being that it's incomplete—http://boardgamegeek.com/ is not blocked—it's easy to work around—tunnelling, proxying, or even just the Google cache—and why should they care what sites I visit, as long as I'm getting work done?). So my guess was that we didn't realize that a Spyware Firewall would come with content filtering turned on by default, or that maybe we knew it but hadn't gotten around to figuring out how to turn it off. According to the systems guy I asked, this is roughly the case, and they are planning to relax some of the restrictions. Why not all? and why "planning to"? Apparently they have to discuss the changes with HR, because there's something related to the Sarbanes-Oxley Act about the workplace environment. This was news to me, and rather surprising. Has anyone heard anything about this before? The only allusion I could find on the net was in an article about content filtering:

Some companies are drawn to Web-filtering solutions by a lack of perceived control, especially in the wake of new regulations like HIPAA and Sarbanes-Oxley, which are meant to protect customer privacy and oversee financial dealings.

Is this just general paranoia (and ignorance) about Sarbanes-Oxley restrictions, or is there really something in there that could be interpreted to mean "companies must filter web content in their employees' browsers"?

Comments

[mizdarkgirl.livejournal.com]

That's a new one on me.

You would want to capture content such as email, text messages and forms of communication. Perhaps restrict them. But that doesn't sound correct.

[cubes.livejournal.com]

I have heard of content-filtering being done to avoid hostile workplace or sexual harrassment problems that might occur if employees were allowed to view potentially offensive websites on monitors that are visible to other employees.

[dougo.livejournal.com]

Has this been specifically related to Sarbanes-Oxley, though? (Nevermind the fact that my reading a board game review is pretty unlikely to offend a coworker.)

[cubes.livejournal.com]

No, this was quite some time ago.

I can see it evolving, though -- you reading a game review might not offend anyone, but it could be construed as inappropriate use of business resources (your time and the company's computers/bandwidth). Yes, it's silly from a techie point of view, but techies aren't on the jury, or the BoD. It's HR's job to be paranoid, and it's the filtering software publisher's job to continually expand their blocking capabilities in order to sell more software.

[lifepawn.livejournal.com]

From a company perspective if you have so much free time to be reading on the net then you must need [u]more[/u] work to keep you a busy little worker bee.
Personally I tend not to socialize with my co-workers during the day and surf the net instead since I find more common interests there. I'd say my time online during the day is equal to or less than the amount people talk about their kids or new recipes or whatever it is they chat about throughout the day instead of working.

[prusik.livejournal.com]

I suspect that Sarbanes-Oxley is a fig-leaf at best. Part of Sarbanes-Oxley, interestingly enough, is that the company must inform all of its employees about Sarbanes-Oxley. I didn't read anything that made me think that content restrictions were necessary to comply with the act.

Of course, I'm pretty sure that all companies do some form of content filtering. I haven't noticed any problems at work except when a web-site gets mislabeled. "Game playing" is a new one on me. I've never seen that as a category before.

I'm not thrilled with the idea of content filtering. OTOH, it's their bandwidth. If I want unfiltered access to the net, I do it any home. However, like I said, that's easy for me to say since nothing I access from work has gotten blocked yet.