Senator Urges Compulsory Encrypted Client Hello for Government Websites Following Audit of 350 At‑Risk URLs

Senator Ron Wyden revealed a drive toward a fresh security benchmark after a review identified over 350 federal web addresses lacking Encrypted Client Hello (ECH), a TLS capability that can protect users from surveillance at the network level.

ECH, built as an extension to the TLS 1.3 protocol, encrypts the Server Name Indication (SNI) field that would otherwise disclose which site a user is reaching. In the absence of this safeguard, passive internet observers can deduce the target of encrypted traffic, risking exposure of sensitive exchanges.

Wyden’s inventory points to a number of high‑profile services—such as the FBI’s online tip portal, the Department of Veterans Affairs crisis‑line site, and numerous whistleblower and civil‑rights hotlines. Each of these sites gathers personal or confidential data, rendering the lack of ECH a significant security shortfall.

Every URL on the list resides on third‑party content‑delivery networks (CDNs). Although CDNs boost performance and offer DDoS protection, they also need particular settings to activate newer TLS extensions. Current federal contracts frequently omit clauses that compel vendors to implement those configurations.

Wyden is calling on the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to incorporate an ECH mandate into federal procurement guidelines, thereby turning the extension into a prerequisite for any contract that hosts government sites.

Cybersecurity analysts argue that the proposal would align federal web security with emerging industry best practices and could curb the ability of nation‑state or criminal actors to carry out passive surveillance. Although agencies may need months to audit and upgrade their sites, the initiative represents a clear move toward modernizing government encryption standards.