Senator warns hundreds of government sites lack encryption that hides visited URLs

Senator Ron Wyden sent a letter to CISA acting director Nick Andersen and OMB deputy chief information officer Thomas Flagg, highlighting that around 350 federal web addresses lack the Encrypted Client Hello (ECH) protocol, which masks the site name from network observers. The list covers high-risk services such as the FBI’s tips.fbi.gov portal, the Veterans Crisis Line hosted on Amazon Web Services, and various intelligence-community job application sites.

Wyden called on CISA and OMB to require agencies to adopt ECH and to make its support a condition for cloud and network providers seeking federal contracts, asking for replies by Nov. 20. He warned that the visibility could enable adversaries to identify whistleblowers, profile cleared personnel, or track individuals seeking crisis assistance. The letter notes that while most federal sites encrypt transmitted data, they still reveal the destination URL, and that enabling ECH is often a simple configuration change for providers that already support it. Wyden’s push follows his earlier request for the NSA to update VPN guidance, emphasizing that modern zero-trust practices would be strengthened by adopting ECH.