Most federal websites encrypt what you read and type on them. Many of them still leak one thing before that encryption starts: the name of the site you are visiting. Sen. Ron Wyden wants that changed. In an October 19 letter to CISA acting director Nick Andersen and OMB deputy federal CIO Thomas Flagg, the Oregon Democrat asks both offices to push federal agencies toward a technology called Encrypted Client Hello, or ECH.

His office found at least 350 federal web addresses that do not support it, CyberScoop reported. Nextgov/FCW saw the letter first. In its report, republished by Defense One, the list includes intelligence community job application sites, immigration sites, health information sites and diplomatic websites. The letter's attached list is described as non-exhaustive, and Nextgov/FCW notes that the letter does not establish that adversaries have tracked visitors to any of the listed addresses.

The letter is a request, not a rule. No agency is under a new mandate today. Still, the asks are specific, and one of them would affect cloud and network vendors that sell to the government.

What leaks today, and what ECH hides

When a browser opens an encrypted connection to a website, the first message it sends is called the "Client Hello." It is a greeting that starts the handshake, and it usually includes the name of the site the browser wants to reach. That name has normally traveled in readable form. So anyone positioned on the network path, such as an internet provider, a Wi-Fi operator or a surveillance tap, can see which site a user is connecting to, even if they cannot read the page.

Encrypted Client Hello protects the name of the website a user visits. According to the letter, it works best with major content delivery networks (CDNs): anyone intercepting the traffic can see which network delivers the content, but cannot directly identify which of the many sites on that CDN was visited. The letter says most major web browsers have supported ECH since October 2023 and Android added support this August. Wyden's argument is that the visitor side is largely ready, and the gap is now on the server side, meaning the agencies and the providers that host their sites.

For some federal sites, the site name says a lot on its own. Someone looking at a connection to a crisis line, a tip portal or an intelligence community job application page learns something about that person without reading a single byte of content.

Two examples, two different problems

The letter's two lead examples show two different reasons a site can lack ECH.

The VA's Veterans Crisis Line is hosted on Amazon Web Services, which, according to the letter, does not currently support ECH. An agency hosted there cannot simply switch the feature on. The provider would have to support it first.

The FBI's tips site, tips.fbi.gov, is hosted by Cloudflare, which already supports ECH. The letter says the portal has not enabled it. That is a configuration gap, not a missing capability. For federal domains on a CDN that supports ECH, the letter says turning it on merely requires a configuration update.

The difference helps explain why the letter goes to two offices. CISA is asked to require agencies to turn on the protection. OMB is asked to use federal contracting terms to bring vendors along. CyberScoop also cited the FTC's fraud reporting portal, reportfraud.ftc.gov, as an example of a site whose name is exposed.

What Wyden is asking for

The letter makes two recommendations:

  • To CISA: require civilian federal agencies to enable ECH across all public-facing websites and inter-agency web systems.
  • To OMB: in coordination with the Office of the National Cyber Director and CISA, establish ECH support as a mandatory condition for commercial cloud and network vendors seeking federal contracts.

The letter cites DHS Binding Operational Directive 18-01, which instructed agencies to encrypt their web services, and National Security Presidential Memorandum 12 (NSPM-12), which requires the securing of unclassified communications. It includes a non-exhaustive list of affected sites. Wyden asked for an unclassified response and action plan by November 20, 2026. CISA and OMB did not immediately respond to a request for comment, according to CyberScoop, and GovExec reported that Nextgov/FCW had requested comment from both.

CyberScoop notes that the letter follows an earlier Wyden letter, first reported by CyberScoop in July, urging federal agencies to get rid of older, insecure, public-facing VPNs.

What happens next

Nothing changes automatically on November 20. That is the date Wyden asked for a response, not a compliance deadline. Policy would change only if CISA issued a requirement for civilian agencies or OMB wrote ECH support into procurement terms. Neither office had said whether it would, as of the reports.

The procurement recommendation would matter most outside government. If OMB made ECH a condition of federal cloud and network contracts, a provider that does not support it for a given service, which the letter says is the case for Amazon on the Veterans Crisis Line site, would have to add support to qualify for those contracts.

What It Means for Defenders

Who is affected. In the near term, mainly federal civilian agencies whose public sites appear on the attached list, and the cloud, CDN and network vendors that host them. Federal contractors should watch OMB's response. Today this is a request from a senator, not a requirement.

What to check now.

  • Know where your sites are hosted. As the two lead examples show, whether you can offer ECH depends first on your hosting or CDN provider. Find out whether each provider you use supports it.
  • Look for features that are available but switched off. The FBI tips site is the cautionary case here: the provider supports ECH, but the site does not use it. If your provider already supports ECH, review whether it is enabled for your domains, starting with the most sensitive ones.
  • Rank sites by how much the name alone reveals. Crisis lines, whistleblower and tip portals, health resources, job applications for sensitive roles, and immigration services leak the most through the site name. Do those first.
  • Expect it to show up in procurement. If you sell cloud or network services to the government, be ready to say whether you support ECH. Under Wyden's proposal, that answer would become a condition of the contract.

Mitigations the sources give. The fix the letter proposes is ECH itself. According to the letter, most major browsers have supported it since October 2023 and Android since this August, so visitors on those clients would benefit once the server side turns it on. There is no patch to install here. This is a privacy hardening step, and how you enable it depends on your hosting stack and your provider's support.

What it does not do. ECH protects the name of the site from eavesdroppers on the network; observers can still see which CDN or network delivers the content. It is not a fix for vulnerabilities in the sites themselves. Treat it as one more layer on top of the encryption agencies already run, not a replacement for it.

Sources