Senator Urges Mandatory Encrypted Client Hello for Federal Websites After Audit Reveals 350 Unprotected URLs

Senator Ron Wyden has called for a fresh security mandate following a audit that identified over 350 government web addresses lacking Encrypted Client Hello (ECH), a TLS capability that can protect users from surveillance at the network level.

As an add‑on to TLS 1.3, ECH encrypts the Server Name Indication field, which would otherwise disclose the exact site a user is reaching. In the absence of this safeguard, passive internet observers can deduce where encrypted traffic is headed, risking the exposure of confidential exchanges.

Among the URLs cited by the senator are prominent services such as the FBI’s online tip portal, the Department of Veterans Affairs crisis‑line site, and numerous whistleblower and civil‑rights hotlines. Since each of these sites gathers personal or sensitive data, the lack of ECH represents a significant security shortfall.

Every URL on the list resides on third‑party content‑delivery networks (CDNs). Although CDNs boost performance and offer DDoS protection, they also need particular settings to activate newer TLS extensions. Current federal contracts frequently omit clauses that compel vendors to apply those configurations.

Wyden is pressing the Cybersecurity and Infrastructure Security Agency (CISA) together with the Office of Management and Budget (OMB) to incorporate an ECH mandate into federal acquisition regulations, thereby turning the extension into a prerequisite for any contract that houses government sites.

According to cybersecurity analysts, the proposal would align federal web security with emerging industry best practices and could curb the ability of nation‑state or criminal actors to perform passive surveillance. Although agencies may need several months to audit and retrofit their sites, the initiative represents a clear move toward updating governmental encryption standards.