Question: A long-time client has asked us to help screen their work machines for pornography. They're worried about liability if sensitive materials were found. Their main concerns (for obvious reasons) are video, audio, and image files. If possible, they'd also like to scan text-based documents for inappropriate content. They have a hierarchy of not-for-work content starting with blatantly illegal (I don't have to list details), moving down to obviously offensive, and also including things that may be offensive to some - think lingerie ads, joke cards featuring butt cracks, and anything related to Howie Mandel.

My questions are:

* Is this ethical? I think it is since every employee legally agrees that their work machine belongs to the company and is subject to search. The screenings are not to occur on personal machines brought to work.
* Is it feasible? I've done a lot of image processing/indexing but this seems like a whole new world of complexity.
* Any references to successful techniques for discovering porn?
* Is it appropriate for me to archive the results when something is discovered?

Answer: 
There are a number of products in the marketplace that perform "content filtering" of various forms. (A Google search on some obvious terms throws up some obvious candidates.) It is probably a better idea to use one of these products than building a lot of scanning / filtering software from scratch. Another option is to just watch at the borders; e.g. by monitoring external emails and web traffic. Again there are products that do this kind of thing.

While there is no doubt that it is ethical for a company to scan its computers for "bad stuff", this does not mean that there aren't issues. 

First issue:

* Determining what is and what is not "objectionable content" is subjective.
* Software for detecting images, videos containing (let us say) "depictions of the naked body" is (AFAIK) likely to be unreliable, resulting in false positives and false negatives.

So ... this means that someone in your customer's organization needs to review the "hits". That costs money.

Second issue: There can be an innocent explanation. The file could have been downloaded by accident, or it could have been planted by a vindictive co-worker. If there is an innocent explanation, the customer's organization needs to be careful what they do / say. (OK this is not really *your* issue, but you might cop some of the backwash.)

Third issue: Not-withstanding that the company has a right to monitor for objectionable material, a lot of employees will find this distasteful. And if they too far, this will impact on employee morale. Some employees will "walk". Others may take protest action ... e.g. by trying to create lots of false positives. (Again, not really *your* issue, but ...)

Fourth issue: People can hide objectionable material by encrypting it, by putting it on portable or removable media, etc. People can fake the metadata to make it look like someone else is responsible.
Image and content analysis to determine the differences between a tasteful photograph of a person, a swimsuit photograph, a nude photograph, depictions of pornography... as far as I know is nowhere near sophisticated enough to do in software alone.

Fortunately crowdsourcing should be useful here, as @ammoQ suggested in a comment. However I don't believe members of 4chan or any other forum would appreciate the vast number of *non*-pornographic images, such as generic web graphics for buttons, frames, advertisements, etc. being posted.

My recommendation would be to look into existing crowdsourcing solutions, such as [Amazon Mechanical Turk](https://www.mturk.com/mturk/welcome). (However the terms of service may explicitly prohibit the involvement of pornographic content, so be advised you might have to find another solution or roll your own.)

To make crowdsourcing feasible, your software should be prepared to do some or all of the following:

* Store information that links the content with the computer it came from
* Identify exact duplicates across the entire inventory and remove them (but origin information is retained)
* Downsample images to some dimension, perhaps 320x200, which is sufficient to identify the content of the image without retaining unnecessary detail and wasting storage space/bandwidth
* Create still images of video content at some regular interval and apply the same downsampling rule

Finally, the database of reduced images that represent the original image and video content is checked by users (or a designated team if you have the resources) according to your company's code of conduct. The program or interface might show a single image at a time, or a screen of thumbnails--whatever you deem best to obtain accurate information.

The identity of the computer from which images came should absolutely be secret and unknown to the persons evaluating the data. Additionally it should be randomized and each image probably checked more than once to remove bias.

The same technique could be used for text, but first the content could be scored by keyword rankings which remove the bulk of text from crowdsource review. Classifying a long document will of course be more time consuming than classifying an image.