Senator Calls for Mandatory Encrypted Client Hello on Federal Sites After Audit Finds 350 Vulnerable URLs

Senator Ron Wyden announced a push for a new security standard after a review uncovered more than 350 federal web addresses that do not use Encrypted Client Hello (ECH), a TLS feature that can shield users from network‑level surveillance.

ECH, an extension of the TLS 1.3 protocol, encrypts the Server Name Indication field that would otherwise reveal the specific website a user is contacting. Without this protection, passive observers on the internet can infer the destination of encrypted traffic, potentially exposing sensitive interactions.

The senator's list highlights several high‑profile services, including the FBI’s online tip portal, the Department of Veterans Affairs crisis‑line site, and a range of whistleblower and civil‑rights hotlines. All of these platforms collect personal or confidential information, making the absence of ECH a noteworthy security gap.

All of the listed URLs are hosted on third‑party content‑delivery networks (CDNs). While CDNs improve performance and provide DDoS mitigation, they also require specific configuration to enable newer TLS extensions. Existing federal contracts often lack language that obligates vendors to adopt such configurations.

Wyden is urging the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to embed an ECH requirement into federal procurement rules, effectively making the extension a condition of any contract that hosts government websites.

Cybersecurity analysts say the measure would bring federal web security in line with emerging industry best practices and could limit opportunities for nation‑state or criminal actors to conduct passive surveillance. While full implementation may take months as agencies audit and update their sites, the proposal marks a decisive step toward modernizing government encryption standards.