"While we can't 100 per cent rule out that the blocked attempts were from people deliberately trying to access a website, far and away the most likely explanation is that these were automatic attempt generated by website advertisements, links and scripts [including tracking cookies], and the user would be completely unaware of it," he said.
Robertson on Tuesday told reporters that, along with the pop-up issue, it was also possible staff had also been looking at the sites as part of their work after the Christchurch mosque shootings.
"The advice I've had was that was a person who doesn't work there anymore," Robertson said.
But he said he would be asking the department to confirm how the blocked attempts had happened.
"I'll be seeking some assurances from Treasury that it is in the nature of a pop-up.
"What I'll be seeking that it's understood that, if in the normal course of events, people have to be looking at these sites they'll be talking to their manager about that."
DoC's deputy director-general corporate services Rachel Bruce earlier told the Herald the organisation was confident staff were not even aware they were accessing pornographic sites.
URLs for porn sites were frequently embedded in legitimate sites which meant people could be referred or directed to blocked sites, she said. DoC's firewall blocked links and referrals to restricted sites.
"We are confident that DoC staff are not searching for adult or X-rated websites. Access to the websites is blocked in any case."
