Our word libraries contain a huge number of words and phrases designed to indicate possible cause for concern. We try to reduce the likelihood of false positives by configuring the capture to trigger either if the target text appears anywhere in a word or as a unique word.

Occasionally, captures will be taken for words where the actual reason for capture is not obvious. This document explains the likely causes of this.

1. Trigger Word is used in an embedded phrase.

This occurs where the trigger word is embedded (IE allows other text around it) and the reason for capture is the combination of letters is visible somewhere in the page.

Foe example, FUD appears in our Profanity library and is a slang term for "fudge packer". It should only trigger a capture if the word is used on its own (ie with spaces around it). Occasionally however, other words, punctuation marks etc can fool the monitoring system into incorrectly detecting the word. In this case, you could get a capture due to 'FUD' but the word on screen is FUD.BOO or a model number of 234FUD

2. Delay between detection and capture

When the PCE engine detects a reason for capture, it invokes a separate piece of code to take the actual screenshot and collect the associated information such as user, group, computer etc. Depending on the speed of the local machine and other processes that may be running on it, the detected word/phrase may have been closed down or scrolled off screen before the capture takes place. This does not mean that misuse will 'slip thorugh' as anything that stays on screen for more than 20 seconds will get captured.

3. Embedded Meta tags or ALT text.

Many web pages contain meta tag data to advertise them to search engines or web 'crawler' software. In addition, web sites often specifiy ALTernative text to be shown in place of graphic images on slow or simple Internet Browsers. PCE will pick up on this text and it can be a reason for capture although rarely displayed. 

For example, a capture of 'HOT SEX' is often attributed to the above.

4. Pop-up Windows

Although most Internet Browsers are configured to not show pop-up windows, the operating system still goes through the process of displaying them and passes the content to the GDI engine of the computer. The Internet Brower shuts the window before it is visible displayed but often PCE will still 'see' the window contents as a reason for capture.

It is not necessary to scan every capture for the offending word/phrase to determine if misuse is occuring. The console user should look at the graphic image in conjunction with the other data such as user, date/time, computer and get an overall impression as to the form of use they are looking at. Generally speaking, the nature of the capture itself will give this information and if it does not, discount the capture and move on to another.

Feb 2010