Wyden Presses CISA, OMB to Mandate ECH Encryption on Federal Sites

Sen. Ron Wyden, D-Ore., is pressing the Trump administration to close a persistent encryption gap that exposes which federal websites Americans visit, warning that foreign adversaries and criminal hackers could exploit that visibility to target whistleblowers, cleared personnel, and veterans in crisis. In an Oct. 19 letter to CISA acting director Nick Andersen and deputy federal chief information officer Thomas Flagg, Wyden asked the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget to require Encrypted Client Hello (ECH) across all public-facing federal websites and interagency web systems. He also asked OMB, working with CISA and the Office of the National Cyber Director, to establish ECH support as a mandatory condition for commercial cloud and network vendors seeking federal contracts. The letter requests an unclassified response and action plan by November 20, 2026.

ECH is a web security standard that conceals the name of the website a user is visiting when a browser establishes a secure connection. While standard HTTPS encryption protects the content users read or submit, it does not hide the hostname announced in the Server Name Indication field during the connection handshake. That means an internet provider, hostile Wi-Fi network, or compromised telecom carrier can log that a connection went to tips.fbi.gov or veteranscrisisline.net without reading the contents of the tip or form submission. According to Wyden's letter, most major browsers have supported ECH since October 2023, Android added support in August 2026, and millions of active websites already use the technology. For websites hosted by providers that already support ECH, enabling the protection may require only a configuration update.

The procurement implications are significant. Wyden's proposal would make ECH support a condition of eligibility for cloud and network providers seeking federal contracts, potentially affecting major vendors such as Amazon Web Services and Cloudflare. Contractors serving the cited services should assess whether their offerings support ECH and what implementation would entail, including access from countries that block the technology. ECH is already blocked in Russia, where some listed U.S. embassy pages are aimed, meaning agencies and vendors may need to account for degraded service in certain jurisdictions. The letter also singles out two high-profile services: the Department of Veterans Affairs' Veterans Crisis Line platform, which uses Amazon Web Services and does not currently support ECH, and the FBI's tips.fbi.gov portal, which runs on Cloudflare—a provider that supports ECH—but has not enabled it. Wyden argued the current arrangement could put veterans seeking mental health assistance and people contacting the bureau at risk of identification.

The letter's inventory identified 350 CDN-hosted federal web addresses without ECH, including FBI tip lines, intelligence community job applications, immigration services, health information resources, whistleblower reporting channels, civil rights complaint hotlines, and U.S. diplomatic websites around the world. Of those, 191 addresses—54.6%—are diplomatic, comprising 174 embassy sites, three consulates, and 14 missions, mostly to international bodies such as NATO and the UN. Another 53 are subdomains. Wyden warned that the visibility "could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies." He framed ECH adoption as building on earlier federal cybersecurity requirements, including DHS's 2017 Binding Operational Directive 18-01, and said the technology would not interfere with federal cybersecurity operations because modern zero trust security practices rely on protective software installed directly on agency devices.

• 350 federal web addresses identified as CDN-hosted without ECH, including FBI tip and VA crisis-support services.
• November 20, 2026 deadline for CISA and OMB to provide an unclassified response and action plan.
• Proposed contract condition would require ECH support from cloud and network vendors seeking federal work.
• 191 of 350 listed addresses (54.6%) are diplomatic: 174 embassy sites, three consulates, and 14 missions.
• Amazon Web Services does not currently support ECH for the VA crisis line; Cloudflare supports it but the FBI has not enabled it.
• ECH has been supported by major browsers since October 2023; Android added support in August 2026.
• ECH is blocked in Russia, where some listed U.S. embassy pages are aimed, requiring mitigation planning.
• No contract award, funding amount, or implementation deadline has been announced.
• CISA and OMB did not immediately respond to requests for comment.
• The proposal follows Wyden's July letter urging agencies to retire older, insecure public-facing VPNs.