CyberScoop reported on Monday that Sen. Ron Wyden, an Oregon Democrat, wrote to the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB). He wants hundreds of federal agencies to use Encrypted Client Hello, or ECH. This tool hides the name of the site a person visits. Wyden said his office found at least 350 sites without it. He gave reportfraud.ftc.gov as one example, and named an FBI tipline and a Department of Veterans Affairs suicide prevention hotline.
Wyden said almost all federal sites use standard web encryption, but that does not hide some site names. He wrote that hackers and foreign actors watching network traffic could see them. According to CyberScoop, he said the FBI tipline supports ECH but does not turn it on. He said the VA hotline lacks ECH because Amazon does not support it. He asked CISA to require ECH on public federal sites and systems that link agencies. He asked OMB to make ECH support a condition for cloud and network vendors seeking federal contracts. CISA and OMB had not answered CyberScoop's request for comment. The sources give no deadline and no word on whether either agency will act.
For teams that run sites on content delivery networks, or sell cloud services to the US government, this letter points to a possible future requirement. Wyden's letter ties ECH support to both site settings and vendor support, as the VA example shows.