- Sen. Ron Wyden says his office found at least 350 federal sites without Encrypted Client Hello, so the name of the site a visitor picks can be seen in transit.
- Wyden points to tip lines, whistleblower channels and crisis services, where the choice of site can say who a person is.
- Ask whether your CDN supports ECH, whether it is switched on, and whether your contracts require it.
A sealed envelope still shows its address. For most mail, that is a small point. For a whistleblower, a veteran in crisis or someone reporting a crime, the address can be the sensitive part. That is the idea behind a letter Sen. Ron Wyden sent on Monday to two federal agencies, as CyberScoop reported.
What Wyden asked for
Wyden, an Oregon Democrat, wrote to the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB). He wants federal agencies to adopt Encrypted Client Hello, or ECH. CyberScoop describes ECH as a tool that protects the name of the website a user visits.
Wyden's office found at least 350 federal sites that do not use ECH. He noted that almost all federal agency sites are already encrypted. Even so, he said, standard encryption leaves some site names exposed. His example was reportfraud.ftc.gov.
How the gap works
Return to the envelope. Standard encryption seals the letter. In the cases Wyden describes, the destination can still be read.
The reason is timing. At the start of a connection, the visitor's browser announces the site name, before the encrypted channel exists. ECH encrypts that announcement. This is general technical background, not a finding from the letter.
Wyden wrote that hackers and foreign actors watching network connections can easily see those names.
He says ECH works especially well with content delivery networks (CDNs). These are shared services that deliver sites for many owners. Wyden wrote of CDNs that connect hundreds of thousands of websites to the internet.
With ECH in place, an observer can still see which network carried the traffic. The observer cannot see which specific site the person chose.
Two different failures
The letter gives examples of two separate problems. The first is an FBI tip line. It supports ECH, but the feature is not turned on.
The second is a Department of Veterans Affairs online suicide prevention hotline. CyberScoop reports it lacks ECH because Amazon does not support it. Here the limit sits with the provider.
Wyden also listed agencies that offer national security personnel services and whistleblower channels. They use CDNs without ECH too.
This shows why one fix is not enough. One lever is an instruction to switch the feature on. The other is a purchasing rule that makes support a condition of the sale.
Why a site name matters
Wyden listed what an observer could do with exposed names. They could pick out whistleblowers and profile cleared federal staff. They could track Americans seeking crisis support. They could also map which agencies talk to each other.
For the FBI tip line, his worry is that a hostile government watching the network could learn who is reporting. These are Wyden's concerns. The CyberScoop report does not describe a case where this has happened.
The two requests
Wyden's first request goes to CISA. He wants civilian federal agencies required to turn on ECH for every public-facing site. He included the systems agencies use to reach one another.
His second request goes to OMB. Vendors that sell cloud or network services to the government would have to support ECH to win the work. In effect, a provider that cannot offer it would be shut out of federal contracts. Wyden wants OMB to design that requirement together with CISA and the national cyber director's office.
CISA and OMB did not immediately respond to CyberScoop's request for comment. CyberScoop says NextGov/FCW first reported the letter. It follows a July letter from Wyden, first reported by CyberScoop. That one urged agencies to retire older, insecure, public-facing VPNs.
Questions for your own team
The letter targets federal agencies. This is WebPulse's interpretation: the same question applies to any organisation whose visitors need privacy about who they are talking to. Tip lines, health services, HR reporting channels and legal intake are examples.
Put four questions to your team. Which of our sites serve people who could be hurt if someone learned they visited? Does our CDN or cloud provider support ECH? If so, is it on? Do our contracts require it, as Wyden proposes for federal vendors?
The answers will show whether this is a setting you can change this week or a provider limit to raise at renewal. Encryption protects the message. ECH protects the address.
Produced by the WebPulse Newsroom with AI assistance from the original reporting credited below, and checked against that source by our editorial review. How we use AI.
Original reporting: CyberScoop.
