Defusing digital time bombs

Many companies invest in Web blocks and filters to stop workers from reaching unsafe or nasty Web sites. What companies haven’t been able to do is identify and detect digital time bombs – illegal or dangerous content such as child porn, buried inside company computers.

If companies buy standard network security tools, administrators can track and analyze data going into or out of a corporate network. What those tools cannot do is look inside or examine the nontext files of all company workers and highlight the ones that don’t belong there.

When companies do discover child porn on a worker’s computer, it’s often due to inadvertent sharing of the material with others in the workplace or accidental distribution of the files.

That’s the scenario that occurred at The Spokesman-Review in the past month. The newspaper’s management announced they had recently fired an online worker whose work computer contained child pornography.

The newspaper, like many companies across the country, subscribes to a third-party service that blocks workers from accessing or reaching gambling, adult-content or hate-related sites.

Despite that filter, the former worker had allegedly found and downloaded child pornography, either at the office or away from the office, using a peer-to-peer application. Such applications – described as file-sharing – allow people to circumvent Web filtering in most cases.

The worker’s files were discovered inadvertently by another company employee using iTunes, which allows users on a local network to stream music to others. In effect, iTunes located files the other worker had unintentionally made public across the company network

That problem may not happen on a large scale, but government officials have already begun discussing laws that make it easier to search inside personal computer files and identify illegal images.

Just last week Sen. John McCain, R-Ariz., said he would introduce a bill to require service providers and some Web sites to alert the government of any illegal images of real or “cartoon” minors sent to or received by users.

Though that law would not apply to companies, the corporate mindset already has moved toward a total monitoring of all employee computer behavior, said Angela Gunn, a security editor for Computerworld, an online tech publication.

“My understanding is that a great many HR departments are telling new hires right up front that the company reserves the right to look at whatever the management needs to look at,” Gunn said in an e-mail.

The Spokesman-Review case is the second time an area firm has reported the discovery of child porn on a worker’s computer, said Spokane police Detective Jerry Keller. But Keller noted there may be cases that haven’t been reported.

At present, the current technical ability to look inside or examine the content of files that involve music, video or pictures is rudimentary at best. In the meantime, many companies are testing or looking for security applications that help identify problem patterns or highlight suspicious worker activity.

Spokane-based NextSentry Corp., for instance, has developed network tools that tackle part of the problem – tracking or stopping workers from moving files in or off the company network.

“Our chief focus is on stopping workers from taking critical information outside the company network, such as sensitive financial information,” said Jim Hereford, CEO of NextSentry.

The company’s chief security tool, called ActiveSentry, can be configured to alert company administrators when a worker does something that violates or varies from the norm. That could include visiting an unauthorized site or transferring a very large file onto the local hard drive.

ActiveSentry can also be set to send alerts if the company network sees any worker transferring a certain number of files containing music, video or images, said Sam Fleming, NextSentry’s chief technology officer.

ActiveSentry, along with several other commonly found Web security systems, can be set to track changes to a laptop once the worker has left the corporate network, said Hereford. That option will track whether or not the worker has visited unauthorized sites after taking the laptop home or to a WiFi hot spot.

While privacy advocates criticize plans to develop more ways to scour computer files for illegal content, people who back the concept argue that child porn has become a significant problem. They note that sharing files via the Web allows a much wider dispersal of such material than ever before.