Question: A long-time client has asked us to help screen their work machines for pornography. They're worried about liability if sensitive materials were found. Their main concerns (for obvious reasons) are video, audio, and image files. If possible, they'd also like to scan text-based documents for inappropriate content. They have a hierarchy of not-for-work content starting with blatantly illegal (I don't have to list details), moving down to obviously offensive, and also including things that may be offensive to some - think lingerie ads, joke cards featuring butt cracks, and anything related to Howie Mandel.

My questions are:

* Is this ethical? I think it is since every employee legally agrees that their work machine belongs to the company and is subject to search. The screenings are not to occur on personal machines brought to work.
* Is it feasible? I've done a lot of image processing/indexing but this seems like a whole new world of complexity.
* Any references to successful techniques for discovering porn?
* Is it appropriate for me to archive the results when something is discovered?

Answer: 
> 
> * Is this ethical?
> 
> 
> 

Depends on the implementation and reasonable expectations of the employees. For example, if your software scans any machine *connected to* the network, then there's an additional requirement that infra needs to prevent unauthorized machines from plugging in. (Maybe that should be obvious, but it's frequently overlooked on networks I've seen.)

> 
> * Is it feasible? I've done a lot of image processing/indexing but this seems like a whole new world of complexity.
> 
> 
> 

Is it feasible to drug test every employee? Maybe so, but I question its worth. I would randomize it. Let employees know their machines may be scanned for inappropriate content at any time.

> 
> * Any references to successful techniques for discovering porn?
> 
> 
> 

I'm not touching this one. I don't think I could keep my sense of humor in check. But watch out for [The Scunthorpe Problem](http://en.wikipedia.org/wiki/Scunthorpe_problem) when searching text.

> 
> * Is it appropriate for me to archive the results when something is discovered?
> 
> 
> 

This one concerns me the most, and I would ask a lawyer. I suspect if you find illegal content you may technically be legally obliged to disclose it. That's bad, particularly if the user was exposed by no real fault of his own. You(r client) will need real legal advice on how to handle this. Get HR and the lawyers involved.
Such things never work reliably.
You can use a blocklist to block domains either on name or on being included on some list (a common practice).
But those lists are never complete, and blocking on name based on criteria can lead to many false positives.

You can block on words appearing in the text of sites, but again this can lead to false positives (and gets very slow as you need to parse every single bit of data that passes through your network in order to detect "naughty bits").

you can block pictures (and maybe sites containing them) that show more than a certain percentage of skintones.
But again it leads to many false positives. A university medical department blocking a medical encyclopedia with images of limbs and torsos showing wounds and skin conditions is a well known example of that.
And of course it'd be racist as it'd only block certain skintones. If you block colours matching Caucasian skin, there's always porn using black actors for example.

Best just trust your employees, and have policies in place for when that trust is broken.