Dormant filters catch out NSW officials

By Brett Winterford on Dec 3, 2010 11:51 AM
Filed under Networking

Erupts into public fury.

An audit of a content filtering system installed in the Parliament of New South Wales has revealed that Macquarie Street officials browsed adult material over a period of four months earlier this year.

The Ernst and Young audit [PDF] also revealed that the IT team at NSW Parliament has a content filtering system installed to monitor and log internet traffic, but had not switched on features of the product that would allow for content to be blocked in real-time.

NSW Parliamentarians were free to 'opt-in' to a clean feed.

The report, which monitored log files between 10 February 2010 and 17 June 2010, revealed that "adult content has been browsed using the Parliament of NSW's IT Infrastructure."

The log files showed that 35 adult-related web sites had been visited, and some 14 adult-related content advertisements had also appeared in pop-up ads. On a hits basis, the report revealed that the second most popular site in all categories was photo galleries within the 'adultmatchmaker' dating site.

Some 210,000 hits were also recorded under a 'swimsuit/lingerie/model' classification.

Of greater concern was that "nine websites that contained sexually explicit images of young people" were found to have been viewed. But the auditors did not feel it was within scope to explore whether this material constituted child pornography.

"You may wish to seek legal advice in relation to these issues," the report said.

The report also noted that the system misfired on several occasions in terms of what it classified as adult material.

Ernst and Young partner Rob Locke noted that whilst the Parliament used the ContentKeeper filtering system, the internet traffic of NSW officials was not blocked on the fly.

"We were advised by your IT Section that no blocking had been implemented in the application for any of the filtering categories until some time towards the end of August 2010," the report said.

"We were also informed that Parliamentary Members have to opt in to the IT policy relating to internet filtering and therefore, are not blocked from certain content by default.

"ContentKeeper has an option to enable Live Filtering which at the time of our analysis was disabled."

9 comments in this discussion

"The system can be correctly audited, but that does not mean that the people managing the system or who have written the report have the appropriate training or expertise to do that. There can be a ..."

By Maxxi2

Tags

nsw, parliament, filter, contentkeeper, adult

NSW retains right to veto data centre co-tenants

NSW Govt pilots 'elastic infrastructure'

NSW Education beefs up school satellite services

Former banker accused of $665,000 fraud

Breaking Stories

Hackett steps down from Internode

ACCC approves Optus NBN deal

Australia shares $2bn Square Kilometre Array

RIM to cut 2000 jobs

NSW retains right to veto data centre co-tenants

Comments: 9

legless Dec 3, 2010 1:15 PM	Oh this is just typical. Pollies and parliamentary workers get to "opt-in" to a filtering system but it is going to be forced on the rest of us. It's a bit like porn being legal in the ACT but not other places. Coincidentally enough, isn't that where the pollies hang out too?
Anon59 Dec 3, 2010 1:56 PM	Keep in mind that as with all filtering software, the classifications of content should be taken with a grain of salt. The classifications are usually supplied by the vendor of the software, so it's up to them how often the classification is updated, and naturally there would be some bias introduced, as this is performed by humans. Note that I am not saying that the persons didn't view the material described. Also, E&Y may have used their own classification system to parse the log files. An additional point is that pages & images embedded in websites appear in log files as being specifically requested by the user. For example, even though the user may not have specifically asked for an image of a woman in a bikini, the news site/blog/whatever may have an advertisement or image embedded in it that contains this content.
HubertCumberdale Dec 3, 2010 2:08 PM	Anon59 pretty much nailed it. Also we dont even know what "nine websites that contained sexually explicit images of young people" would even mean these days since people like to change these definitions on a daily basis, what does young people mean? under 30? under 18? sexually explicit? that could mean anything these day too as people become more prudish.
Res Dec 3, 2010 2:56 PM	Adults browsing Adult sites OMG REALLY? (sarcastic smiley) @HubertCumberdale "what does young people mean? under 30? under 18?" Indeed, I'm sure those in such a position to audit are likely in their 50's - 60's, as such a 30yo is a young person. @Anon59 "not have specifically asked for an image" Also so true. Makes you wonder about the calibre of those who are apparently auditors.
Ace Dec 3, 2010 3:16 PM	It's a sad day when you can't even browse a bit of porn in your lunch hour. Besides, I'm sure these were just people doing some online shopping for their wives/girlfriends birthday presents.
dennisp1 Dec 6, 2010 11:19 AM	Does anyone know how much E&Y charged for this work? There's an extensive list of caveats on the findings, some of which suggest (by my reading at any rate) that there wasn't much buy-in within Parliament to the idea of actively filtering users' internet access.
Ezy2Confuze Dec 7, 2010 5:40 PM	I run weekly reports on usage for our staff, compared to some places I've worked, our people are angels. Twitter, Youtube and Facebook usage is very limited, of the top 100 sites by content alone, 98 of the sites were advertisement Servers. On the other hand, the previous place I worked, in one day, I saw 6 married male co-workers all visiting the RSVP web site. These were people working in an IT company that knew we were watching them.
pameacs Dec 8, 2010 8:12 AM	I didn't have the time to read the report, but now I have it seems all the more interesting. Why did the report get conducted outside of Australian Audit Standards, was that because then certain things would have had to be brought to the attention of police?. Why did the government care about RSVP and its classification. Why is there a filtering system in place that no one can correctly audit anyway as the vendor doesn't appear to have change control, ie a log of the automatic updates. A legally important missing link I would have thought. "Gee your honour we couldn't actually tell you if that was classified or not at the time as the filter just changes itself. The other really interesting part is the missing logs. Poor record keeping practices by the team to have all logs available for audit. I wonder who has those on a USB stick or who ordered then removed. The reference of the young looking is that they look 18 initially, but could be younger. If there is doubt this would have most likely needed to be reported to the police by the audit team, as a potential breach of law may have occurred.
Maxxi2 Dec 8, 2010 2:18 PM	The system can be correctly audited, but that does not mean that the people managing the system or who have written the report have the appropriate training or expertise to do that. There can be a plethora of reasons for that. There is no indication at all that the vendor manages the system, they just speak of the system capabilities. The system will have change control logs, they all do. Again, just because their usage is not mentioned does not mean these are not available. Another aspect here is the ContentKeeper settings and categorisation metrics. These are not legally binding nor calibrated against some legal standards, but will be automated categorisations with some configuration options to set triggering levels. There is no reference to these settings, which means that the potentially suspect sites will need to be manually reviewed before anyone gets their knickers in a knot about potential legal aspects. Naturally not good if folks are using such systems to do online dating and lingerie purchases, but hardly reasons for eruptions of public fury. Different story if it is proven that staff et al used the systems to visit CSAI or similar prohibited sites. The report only speaks of the classifications and hits seen in the logs, not of any reviews of the actual pages... Sounds like a load of fluff over some weakly regulated online systems and a group of people with typically too much free time on their hands...