Wyden’s office identified 350 federal web addresses that lack a widely supported encryption feature, and the senator is pressing the government to close what he calls an avoidable gap that could let foreign adversaries infer who visits sensitive U.S. government sites.
Sen. Ron Wyden's letter to CISA acting director Nick Andersen and OMB deputy federal CIO Thomas Flagg
Sen. Ron Wyden, D-Ore., sent a letter to Cybersecurity and Infrastructure Security Agency (CISA) acting director Nick Andersen and Office of Management and Budget (OMB) deputy federal chief information officer Thomas Flagg asking the agencies to require federal web services implement the Encrypted Client Hello (ECH) web security standard. Wyden asked OMB, working with CISA and the Office of the National Cyber Director, to require cloud and network providers to support the technology in order to qualify for federal contracts, and requested responses by Nov. 20. The letter was first seen by Nextgov/FCW; Nextgov/FCW has requested comments from CISA and OMB.
Encrypted Client Hello (ECH): the protection Wyden wants deployed
Encrypted Client Hello, or ECH, is a protocol that “hides the name of the website someone is visiting” at the moment a browser connects to a site, according to Wyden’s letter. Major browsers and some web infrastructure providers have supported ECH since 2023. Federal sites typically encrypt the content that users read or submit, but Wyden’s letter highlights that internet traffic monitoring can still reveal which sites a user visits unless the site uses ECH.
Wyden argued the protection is practical to deploy: for agencies whose providers already support ECH, enabling it can be “as simple as changing a setting.” He added that “modern federal zero trust cybersecurity practices rely on protective software installed directly on agency devices, so enabling [Encrypted Client Hello] would strictly improve the cybersecurity of federal networks.”
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleFederal web addresses listed by Wyden and how the list was compiled
Wyden’s office identified 350 federal web addresses it says do not implement ECH. The roster includes sites that facilitate intelligence community job applications, immigration services, health information, and U.S. diplomatic websites around the world. Examples named in the letter include apply.intelligencecareers.gov, hotline.oig.dhs.gov (the DHS inspector general’s complaint hotline), civilrights.justice.gov, hivinfo.nih.gov, and clinicalinfo.hiv.gov.
To build the list, Wyden’s staffers tested federal web addresses using third‑party network providers to determine whether ECH successfully hid which specific websites were being visited, a spokesperson told Nextgov/FCW. The staff found that the protection only appeared to work on sites relying on Cloudflare’s free service tier, the spokesperson added. The letter explicitly does not establish that adversaries have tracked visitors to any of the listed addresses.
Exposure highlighted for the Veterans Crisis Line and FBI tips portal
Wyden singled out two services where he said the absence of ECH could be particularly harmful. The Department of Veterans Affairs’ Veterans Crisis Line platform uses Amazon Web Services, which the letter says “does not currently support ECH” for that site; Wyden warned the exposure “could help foreign adversaries identify veterans seeking mental health assistance.”
Wyden also noted that the FBI’s tips.fbi.gov portal uses Cloudflare — a provider that supports ECH — but that the portal itself has not enabled the feature. He argued the current arrangement “could put people contacting the bureau at risk of identification.” The possible FBI exposure was flagged alongside a separate note in the letter that a prolific criminal hacker group recently stole troves of sensitive employee information tied to the bureau’s jobs portal.
Procurement leverage, past requests, and the looming November deadline
Beyond urging agencies to turn on ECH, Wyden asked OMB to make support for the standard a condition of federal contracting for cloud and network providers. The senator set a November 20 response deadline for CISA and OMB to explain how they will close the gap. The push follows Wyden’s September call for the National Security Agency to update its guidance about virtual private networks; a Congressional Research Service analysis requested by his office at the time warned that foreign intelligence services with broad visibility into internet traffic could potentially connect VPN users to websites by comparing traffic patterns.
Wyden’s letter frames the issue as actionable and narrow: a widely supported protocol is already in mainstream browsers and implemented by some providers, the staff tests show gaps across hundreds of federal addresses, and enabling ECH where it is supported can be relatively simple. The next concrete step is the agencies’ written response by Nov. 20 and any procurement changes OMB may require to compel broader support from cloud and network vendors.
