Wyden urges federal agencies to adopt Encrypted Client Hello for web security
The senator warns that unencrypted website names expose whistleblowers and veterans to surveillance by foreign actors and hackers.
Key points
- Sen. Ron Wyden identified at least 350 federal sites lacking Encrypted Client Hello protections.
- Standard encryption does not hide website names, allowing interceptors to see which specific agency pages users visit.
- Wyden recommends CISA mandate ECH for all public-facing federal websites and federal contracts.
Sen. Ron Wyden urged federal agencies on Monday to adopt Encrypted Client Hello technology to protect sensitive user traffic. The Oregon Democrat sent a letter to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget demanding immediate action to secure whistleblower channels and crisis support sites.
Wyden’s office identified at least 350 federal websites that do not use these protections. He warned that without ECH, hackers and foreign actors can monitor network connections to see the specific names of websites users visit. This visibility allows adversaries to identify whistleblowers, profile cleared personnel, and track Americans seeking mental health or crisis support.
Technical Gaps in Federal Encryption
While almost all federal agency websites use standard encryption, that method does not secure the names of the sites being visited. Wyden cited reportfraud.ftc.gov as an example of a site where the domain name remains visible to observers on the network. Standard TLS encryption protects the content of the communication but leaves the server name indication exposed in the initial handshake.
Encrypted Client Hello addresses this gap by concealing the specific website name from anyone intercepting the traffic. For websites delivered by Content Delivery Networks, ECH allows interceptors to see the network delivering the content but not the specific site hosted on that network. This distinction is critical for protecting the privacy of users accessing sensitive government services.
Agencies and Systems at Risk
Several high-profile federal systems currently lack adequate ECH protection. An FBI tipline supports the technology but does not enable it, leaving users vulnerable to identification while submitting crime tips. A Department of Veterans Affairs online suicide prevention hotline is also unprotected because its Amazon infrastructure does not currently support the feature.
Other affected systems include agencies offering national security personnel services and dedicated whistleblower channels. Wyden warned that foreign adversaries could use this exposure to map interactions between agencies and identify individuals seeking to report fraud or misconduct. The lack of ECH on these specific platforms creates a significant surveillance vector for hostile actors monitoring federal network traffic.
What should you do?
Wyden made two specific recommendations to CISA and OMB leadership. He stated that CISA should require civilian federal agencies to enable ECH protections across all public-facing websites and inter-agency web systems. Additionally, he urged OMB to coordinate with the Office of the National Cyber Director and CISA to make ECH support a mandatory condition for commercial cloud and network vendors seeking federal contracts.
What to do and how to stay safe: Encrypted Client Hello
- Review your organization's public-facing websites to determine if Encrypted Client Hello is enabled on your CDN or hosting provider.
- Check if your vendor contracts include requirements for advanced encryption standards like ECH for federal or sensitive clients.
- Monitor announcements from CISA and OMB regarding new mandatory security conditions for federal cloud vendors.
- Ensure that whistleblower and crisis support channels use infrastructure that supports hiding server names from network observers.
Step-by-step guide: Mobile Device Security: How to Protect Data Beyond Passwords
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is Encrypted Client Hello?
It is a cybersecurity technology that protects the name of the website visited by a user, preventing interceptors from seeing which specific site is being accessed.
How many federal sites lack this protection?
Sen. Wyden’s office identified at least 350 sites that do not use Encrypted Client Hello protections.
Which agencies are affected?
Affected systems include an FBI tipline, a VA suicide prevention hotline, and agencies offering whistleblower channels and national security personnel services.
