Employees at the U.S. Department of the Interior (DoI) spend significant time on sexually explicit and gambling websites and even more time shopping and playing online games while at work, according to a report released Wednesday.Employee time spent at Internet auction and gaming sites cost the agency an estimated 104,221 hours in lost productivity in a year, according to the report, released by the agency’s inspector general. The estimated cost in lost productivity to the department is more than $2 million a year, the inspector general’s report said.In reviewing one week of computer use logs at the department, the inspector general found more than 4,700 log entries to sexually explicit or gambling websites, which are prohibited in the DoI’s Internet use policy. In addition, the inspector general found more than 1 million log entries, from 7,763 DoI employees who accessed online gaming and auction sites, the report said.The continued access to porn and gambling sites is “due to a lack of consistency in department controls over Internet use,” DoI Inspector General Earl Devaney wrote in the report. Surfing porn and gambling sites not only wastes time, but it also could expose the agency’s computers to malware such as viruses or keystroke loggers, said Yuval Ben-Itzhak, chief technology officer of Web security firm Finjan. Porn and gambling sites “usually are the first ones to distribute malicious code,” he said.A DoI spokeswoman didn’t immediately return a phone call seeking comment on the report. The agency sent a memo to all employees last week, reinforcing its Internet use policy. The Department of the Interior, the agency that focuses on protecting U.S. natural resources, does not expressly prohibit employees from going to online auction and gaming sites, the report said.One employee computer had spent close to 14 hours at two Internet gaming sites during the week. Another had spent about 12 hours at one gaming site, and a third had spent nearly 10 hours at a gaming site, the report said.Despite three recent cases in which child pornography was found on DoI employees’ computers, the agency has no system-wide infrastructure for Internet monitoring and blocking, the report said. Four of the agency’s six bureaus surveyed in the report are using monitoring and blocking software programs “to varying degrees and with some success,” the report said.In the Bureau of Reclamation, the value of the blocking and monitoring software is “questionable,” the report said. The inspector general found 148 computers in the bureau that had accessed sexually explicit websites during the week.In DoI’s Office of Surface Mining, it appears that Internet use reports are generated only when a supervisor requests one, “rendering the system useless for any real proactive measures,” the inspector general said.The department has taken only 177 disciplinary actions against employees for inappropriate Internet use since 1999, the report said. “The low number of disciplinary actions reportedly taken … compared to the thousands of hits we found indicating user activity at inappropriate sites suggests that employees are not being held accountable,” the report said. The DoI should develop a unified approach to address inappropriate Internet use, including a more consistent use of disciplinary action, the inspector general recommended.By Grant Gross, IDG News Service (Washington Bureau)Keep checking in at our Security Feed for updated news coverage. Related content feature Top cybersecurity M&A deals for 2023 Fears of recession, rising interest rates, mass tech layoffs, and conservative spending trends are likely to make dealmakers cautious, but an ever-increasing need to defend against bigger and faster attacks will likely keep M&A activity steady in By CSO Staff Sep 22, 2023 24 mins Mergers and Acquisitions Mergers and Acquisitions Mergers and Acquisitions brandpost Unmasking ransomware threat clusters: Why it matters to defenders Similar patterns of behavior among ransomware treat groups can help security teams better understand and prepare for attacks By Joan Goodchild Sep 21, 2023 3 mins Cybercrime news analysis China’s offensive cyber operations support “soft power” agenda in Africa Researchers track Chinese cyber espionage intrusions targeting African industrial sectors. By Michael Hill Sep 21, 2023 5 mins Advanced Persistent Threats Cyberattacks Critical Infrastructure brandpost Proactive OT security requires visibility + prevention You cannot protect your operation by simply watching and waiting. It is essential to have a defense-in-depth approach. By Austen Byers Sep 21, 2023 4 mins Security Podcasts Videos Resources Events SUBSCRIBE TO OUR NEWSLETTER From our editors straight to your inbox Get started by entering your email address below. Please enter a valid email address Subscribe