DC Porn Scandal Highlights Need for Data Control

When Vivek Kundra, the new chief technology officer for the city of Washington, started to investigate Web use in his network last December, he couldn't predict that his data management tactics would lead to a major scandal involving 18 government agencies.

But that's just what happened. Last week, results of monitoring by Kundra's team lead to D.C. Mayor Adrian M. Fenty's firing nine people after software from Websense indicated they had accessed pornographic Websites from government computers more than 19,000 times apiece in 2007. About 32 others got reprimands for surfing porn sites more than 2,000 times during the year.

Among the 18 government agencies with fired employees were the Office of Property Management, the Office of Contracting and Procurement, and the Child and Family Services Agency.

The news starkly illustrates why many firms are choosing to add filtering software to their lineup of data management wares. According to Websense, employee activity on the Internet is responsible for an enormous amount of corporate liability to lawsuit and data risk. Websense's Website states that "1 in 3 corporations have spyware on their networks; 45% of IT managers reported that viruses have infected their company's network; 70% of all internet porn traffic occurs during the 9 to 5 work day."

Websense, which made news by acquiring leak prevention vendor PortAuthority for $90 million in 2006, competes with a growing roster of companies that includes Blue Coat, St. Bernard Software, and 8e6 Technologies, to name just a few. Each of these vendors aims to save companies from allowing email and other content on their networks that could subject them to compliance or legal action.But Websense Enterprise, the software that nabbed the porn violators in Washington, wasn't in widespread use in the headquarters where Vivek Kundra became CTO for Washington, D.C., in the spring of 2007. At that time, the former startup CEO and SAIC consultant had inherited 10,000 Websense licenses originally purchased in the 1990s, even though the overall number of multi-agency workstations was closer to 30,000.

Only after an employee in the Office of Property Management complained about coworkers' browsing habits on December 15 was Kundra approached to solve the problem. It wasn't the time to launch a fresh RFP. By shelling out about $142,000 to order Websense Enterprise licenses for 20,000 more computers (for both Windows and non-Windows PCs), Kundra was able to get the job done in a few weeks.

The reports, obtained by using Websense to scrutinize network records forensically, were shocking: Nine employees had racked up an average of 100 hits a day on pornographic sites over a period of 200 working days -- at least 20,000 hits apiece. "The top talker had 48,000 for the year," Kundra said. "It was a gross violation of public trust."

A spokesman for one of Websense's competitors, St. Bernard Software, says he's not surprised by the results Kundra turned up. "It resonates. It's believeable to me," says Andrew Lochart, the supplier's VP of marketing. "Not every employee is there for the cause." He wonders, though, whether the numbers reported by Websense may have reflected any automatic opening of multiple windows in response to a single access request.

Not a chance, said Vivek Kundra, when we passed along this question. The figures published above accounted for user-initiated access to porn sites.Websense wouldn't comment on Kundra's use of its product. But Kundra himself says he's happy with the software, though he emphasizes that he's always looking at new possibilities. And he says his office will continue to deploy Web filtering technology.Have a comment on this story? Please click "Discuss" below. If you'd like to contact Byte and Switch's editors directly, send us a message.