Wyden Urges Federal Agencies to Adopt Encryption to Protect Sensitive Website Visits
Summary
Sen. Ron Wyden urged CISA and OMB to require Encrypted Client Hello for federal websites and certain contractors, saying at least 350 agency sites lack the protection for sensitive web traffic.
Key points
- Wyden said his office identified at least 350 federal websites that do not use Encrypted Client Hello (ECH).
- ECH can hide the specific website a person visits from network observers; standard web encryption may leave that name visible.
- Wyden cited reportfraud[.]ftc[.]gov as an example of a site whose name could be exposed.
- Examples he identified include an FBI tipline that supports but does not enable ECH and a VA suicide-prevention hotline that lacks ECH because Amazon does not support it.
- Wyden recommended that CISA require civilian agencies to enable ECH on public-facing and inter-agency websites.
- He also urged OMB, CISA, and the Office of the National Cyber Director to make ECH support mandatory for commercial cloud and network vendors seeking federal contracts.
Article Details
- Event Type
- Sen. Ron Wyden urged CISA and OMB to require Encrypted Client Hello (ECH) protections across federal websites and inter-agency systems and to make ECH support a condition for commercial cloud and network vendors seeking federal contracts.
- Impact
- Wyden said at least 350 federal sites lack ECH protections, potentially exposing the names of sensitive websites visited to network observers. He warned this could enable identification of people submitting tips or seeking crisis support, profiling of cleared personnel, and mapping of agency interactions. The article reports no confirmed exploitation or resulting harm.