I wonder if they load the whole list of "bad" terms on the client-side. Wouldn't that trigger the firewall? Unless they encrypt it, or use a bloom filter (which would save some bandwidth)...
not sure if a bloom filter with false positives would be a good idea in this case.