They usually buy a peice of hardware that has a company maintain a list of sites, such as X-stop.
If whatever they use dosen't actually break open the packet and look at it, you can just use a proxy to get by that.