A method for selectively performing man in the middle decryption by data processing apparatus, the method comprising: receiving , by a gateway on a network from a client device within the network, a Hypertext Transfer Protocol request addressed to a first resource on a server outside the network; determining, by the gateway, a class of network traffic of which the received Hypertext Transfer Protocol request is a member, the determining being based on a comparison of the first resource with a rule defining destinations associated with encrypted communication traffic for each class; selecting , by the gateway, a man-in-the-middle gateway within the network from a plurality of available man-in-the-middle gateways within the network, wherein each available man-in-the- middle gateway is associated with a class of network traffic and wherein the selected man in the selected middle gateway is selected based on having a class that is the same as the determined class of the Hypertext Transfer Protocol request; sending , from the gateway to the client device, a message redirecting the Hypertext Transfer Protocol request to the selected man-in-the-middle-gateway within the network; establishing (310/312, 314/316) a first encrypted connection between the client device and the selected man-in- the-middle-gateway, and a second encrypted connection between the selected man-in-the-middle-gateway and the server; retrieving , by the selected man-in-the-middle-gateway, the first resource from the server; modifying the first resource to change pointers within the first resource to point to location in a domain associated with the selected man-in-the-middle-gateway within the network; and serving , by the selected man-in-the-middle-gateway to the client device, the modified first resource. receiving , by a gateway on a network from a client device within the network, a Hypertext Transfer Protocol request addressed to a first resource on a server outside the network; determining, by the gateway, a class of network traffic of which the received Hypertext Transfer Protocol request is a member, the determining being based on a comparison of the first resource with a rule defining destinations associated with encrypted communication traffic for each class; selecting , by the gateway, a man-in-the-middle gateway within the network from a plurality of available man-in-the-middle gateways within the network, wherein each available man-in-the- middle gateway is associated with a class of network traffic and wherein the selected man in the selected middle gateway is selected based on having a class that is the same as the determined class of the Hypertext Transfer Protocol request; sending , from the gateway to the client device, a message redirecting the Hypertext Transfer Protocol request to the selected man-in-the-middle-gateway within the network; establishing (310/312, 314/316) a first encrypted connection between the client device and the selected man-in- the-middle-gateway, and a second encrypted connection between the selected man-in-the-middle-gateway and the server; retrieving , by the selected man-in-the-middle-gateway, the first resource from the server; modifying the first resource to change pointers within the first resource to point to location in a domain associated with the selected man-in-the-middle-gateway within the network; and serving , by the selected man-in-the-middle-gateway to the client device, the modified first resource. <EOS>