Sen. Wyden urges CISA and OMB to mandate Encrypted Client Hello across 350+ federal agency websites
Sen. Ron Wyden sent a letter to CISA and the Office of Management and Budget (OMB) urging federal adoption of Encrypted Client Hello (ECH). ECH hides the name of the website a user visits from anyone monitoring network traffic. His office identified at least 350 federal sites that do not use ECH. Wyden warned that hackers and foreign adversaries could passively observe the exposed site names and identify whistleblowers, profile cleared federal personnel, track Americans seeking crisis support, and map interactions between agencies. This is a policy advocacy action, not a reported compromise, and no exploitation was described.
Technical Details
- Almost all federal sites use standard web encryption, but it does not conceal the website name, for example reportfraud.ftc.gov.
- ECH is most effective with Content Delivery Networks (CDNs). An observer can see the CDN network but not the specific site behind it.
- An FBI tipline supports ECH but has not enabled it. A Department of Veterans Affairs online suicide prevention hotline is not protected because Amazon does not support ECH. Other affected sites include national security personnel services and whistleblower channels.
- Wyden warned that foreign adversaries might be able to identify someone submitting crime tips to the FBI.
Remediation
- CISA should require civilian federal agencies to enable ECH across all public-facing websites and inter-agency web systems.
- OMB, in coordination with the Office of the National Cyber Director and CISA, should make ECH support a mandatory condition for commercial cloud and network vendors seeking federal contracts.
- CISA and OMB had not responded to a request for comment. The letter follows a July Wyden letter urging agencies to retire older, insecure, public-facing VPNs.
Linha do tempo
-
Sen. Wyden urges CISA and OMB to mandate Encrypted Client Hello across 350+ federal agency websites
ler a análise desta fonte ocultar
Sen. Ron Wyden sent a letter to CISA and the Office of Management and Budget (OMB) urging federal adoption of Encrypted Client Hello (ECH). ECH hides the name of the website a user visits from anyone monitoring network traffic. His office identified at least 350 federal sites that do not use ECH. Wyden warned that hackers and foreign adversaries could passively observe the exposed site names and identify whistleblowers, profile cleared federal personnel, track Americans seeking crisis support, and map interactions between agencies. This is a policy advocacy action, not a reported compromise, and no exploitation was described.
Technical Details
- Almost all federal sites use standard web encryption, but it does not conceal the website name, for example reportfraud.ftc.gov.
- ECH is most effective with Content Delivery Networks (CDNs). An observer can see the CDN network but not the specific site behind it.
- An FBI tipline supports ECH but has not enabled it. A Department of Veterans Affairs online suicide prevention hotline is not protected because Amazon does not support ECH. Other affected sites include national security personnel services and whistleblower channels.
- Wyden warned that foreign adversaries might be able to identify someone submitting crime tips to the FBI.
Remediation
- CISA should require civilian federal agencies to enable ECH across all public-facing websites and inter-agency web systems.
- OMB, in coordination with the Office of the National Cyber Director and CISA, should make ECH support a mandatory condition for commercial cloud and network vendors seeking federal contracts.
- CISA and OMB had not responded to a request for comment. The letter follows a July Wyden letter urging agencies to retire older, insecure, public-facing VPNs.