Sen. Ron Wyden, D-Ore., urged the Trump administration to address a privacy gap that could let foreign adversaries and hackers monitor visits to sensitive federal websites.
In an Oct. 19 letter to the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB), obtained by MeriTalk, Wyden called for federal agencies and technology vendors to adopt Encrypted Client Hello (ECH), a technology designed to conceal the names of websites people visit.
The letter includes a list of 350 executive branch websites that use content delivery network (CDN) infrastructure without ECH protection. The sites include law enforcement tip lines, whistleblower reporting channels, national security personnel services, and mental health crisis resources.
Although most federal websites encrypt information exchanged with visitors, standard encryption does not necessarily conceal the names of the websites being accessed. That information can remain visible to parties monitoring internet traffic, potentially exposing visits to sensitive government services, according to Wyden.
“Hackers and foreign actors monitoring network connections can easily see these exposed website names,” Wyden wrote, warning that the information could be used to identify whistleblowers, profile cleared federal personnel, track Americans seeking crisis support, and map interactions between government agencies.
ECH is designed to conceal a website’s name when a browser establishes a secure connection, making it more difficult for outside observers to identify which government services a person is accessing.
“It is particularly effective when used by major Content Delivery Networks (CDNs), which connect hundreds of thousands of different websites to the internet. When ECH is used on a website delivered by a CDN, anyone intercepting a user’s web traffic can see which network is delivering the content but cannot directly identify the specific site visited among the many websites hosted on the same CDN,” Wyden wrote.
Most major web browsers have supported ECH since October 2023, according to Wyden’s letter. Android added support in August 2026, and millions of active websites already use the technology, he wrote.
For government websites hosted by providers that already support ECH, Wyden said enabling the protection may require only a configuration update. He also said the technology would not interfere with federal cybersecurity operations because modern zero trust security practices rely on protective software installed directly on agency devices.
Wyden also pointed to earlier federal cybersecurity requirements as a foundation for broader ECH adoption, including the Department of Homeland Security’s 2017 Binding Operational Directive 18-01, which directed agencies to strengthen the security of federal websites and email services.
He also cited National Security Presidential Memorandum 12, which addresses protection of unclassified communications.
FBI tip portal and veterans’ crisis service among examples
Wyden highlighted two federal websites as examples of the potential exposure.
The Department of Veterans Affairs operates a suicide prevention service at veteranscrisisline.net. According to the letter, Amazon Web Services (AWS) hosts the website, which encrypts the content delivered to visitors but does not conceal the site’s identity.
Wyden said AWS does not currently support ECH, leaving the website’s name potentially visible to parties monitoring internet connections.
That exposure could allow foreign adversaries to identify veterans accessing the service during a mental health crisis, he warned.
The letter also cites tips.fbi.gov, the FBI’s online tip portal. Cloudflare, which hosts the site, supports ECH, but the protection has not been enabled for the portal, according to Wyden.
As a result, an outside observer monitoring network connections could potentially identify people visiting the FBI’s tip website, raising privacy concerns for individuals seeking to provide information to federal law enforcement.
Wyden seeks mandatory protections and vendor requirements
Wyden asked CISA to require civilian federal agencies to enable ECH across public-facing websites and interagency web systems.
He also urged OMB, working with the Office of the National Cyber Director and CISA, to make ECH support a mandatory condition for commercial cloud and network vendors seeking federal contracts.
Wyden requested an unclassified response and an action plan detailing progress on both recommendations by Nov. 20, 2026.