"As data travels across the internet, hackers and foreign actors monitoring network connections can easily see these exposed website names," Sen. Ron Wyden wrote, warning that that visibility can identify whistleblowers, profile cleared federal personnel and track Americans seeking crisis support.
Sen. Ron Wyden's letter to CISA and OMB
On Monday, Sen. Ron Wyden urged the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to take concrete steps to deploy a specific privacy-preserving encryption feature across hundreds of federal web properties. Wyden’s office identified at least 350 federal sites that do not use the protections he wants applied, and he framed the gap as a real operational risk for people interacting with agency websites.
What Encrypted Client Hello (ECH) protects
Wyden’s letter focuses on Encrypted Client Hello (ECH), a technique that shields the name of the website a user visits. The senator noted that while "almost all federal agency websites are encrypted," standard web encryption can still expose some website names to observers on the network. ECH, by contrast, hides that specific site name from anyone intercepting a user’s traffic: an interceptor can see the network or content delivery service delivering content but not the identity of the particular site the person visited.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildContent Delivery Networks, federal sites, and the exposure risk
Wyden singled out Content Delivery Networks (CDNs) as a key technical reason why ECH matters. Because CDNs connect hundreds of thousands of websites to the internet, Wyden said ECH is "especially effective" when those networks are in use: without ECH, anyone monitoring network connections may be able to infer which specific site a user requested even if the page content is encrypted. The senator warned this visibility “could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies.”
Concrete federal examples named in the letter
- Wyden’s office identified individual federal services that lack ECH protections. He cited reportfraud.ftc.gov as an example of a site whose name can be exposed despite encryption.
- He said an FBI tipline is using CDN infrastructure that supports ECH but does not have ECH enabled, creating a gap between capability and deployment.
- He noted a Department of Veterans Affairs online suicide prevention hotline is not protected by ECH because the involved Amazon infrastructure does not support the feature, according to the letter.
- He also listed other agency services delivered via CDNs that cover national security personnel services and whistleblower channels as lacking ECH protections.
Wyden’s formal recommendations to CISA and OMB
The letter advanced two specific policy actions. First, Wyden said, "CISA should require that civilian federal agencies enable the protections of ECH across all public-facing websites and inter-agency web systems." Second, he proposed that "OMB, in coordination with the Office of the National Cyber Director and CISA, should establish support for ECH protections as a mandatory condition for commercial cloud and network vendors seeking federal contracts." CISA and OMB did not immediately respond to a request for comment on the letter, which was first reported by NextGov/FCW.
What this means for technologists, policymakers, and veterans and whistleblowers
- Technologists and security teams: Teams running federal web properties will need to inventory which sites sit behind CDNs or commercial cloud networks and determine whether their current vendors and configurations support ECH; Wyden’s letter notes several cases where capability exists but is not enabled.
- Policymakers and procurement leaders: OMB, the Office of the National Cyber Director and CISA are asked to translate ECH support into procurement requirements for commercial cloud and network vendors seeking federal contracts, a change that would shift vendor obligations as well as agency acquisition language.
- Veterans, whistleblowers, and other users: According to Wyden, the practical effect of broader ECH deployment would be to reduce the ability of eavesdroppers or foreign actors to determine which specific government services a person is contacting—an outcome the senator tied directly to safety and privacy for crisis responders and tip submitters.
Wyden’s letter follows an earlier push in July, when he urged agencies to retire older, insecure public-facing VPNs—another effort reported by CyberScoop—signaling a sustained focus on closing technical visibility gaps that could expose sensitive behaviors online. With at least 350 federal sites flagged as lacking ECH protections and examples ranging from an FBI tipline to a VA suicide prevention hotline, the central question left by the record is whether CISA and OMB will move from guidance to requirement, and how quickly agencies and their vendors can enable ECH across the federal web estate.
https://cyberscoop.com/wyden-urges-federal-adoption-encrypted-client-hello/
