Wyden: 350 federal web address leak visitor data

US Senator Ron Wyden has warned officials that the federal government has yet to switch on a privacy feature that major web browsers have supported for three years. According to Wyden, hundreds of agency web addresses still broadcast, in the clear, which site each visitor is connecting to, so that anyone watching the network can see it.

In a letter to CISA Acting Director Nick Andersen and Federal CIO Thomas Flagg, Wyden asked that Encrypted Client Hello (ECH) be required on federal websites and that ECH support become a condition for cloud and network providers seeking federal contracts. The letter attaches a list of 350 executive branch addresses that sit behind content delivery networks (CDNs) but do not use ECH. Wyden set a deadline of November 20, 2026 for a non-classified response and an action plan.

The one detail HTTPS leaves exposed

Nearly all federal sites now encrypt the pages people read and the forms they submit. But standard HTTPS does not hide the server name itself. When a browser sets up a secure connection, it announces which site it wants to reach in a field called Server Name Indication, in plain text, before encryption begins. An internet service provider, a malicious Wi-Fi network or a compromised telecom operator may not be able to read the content of a tip, yet it can still log that the connection went to tips.fbi.gov.

ECH encrypts that information during connection setup. It works best behind large CDNs, where thousands of unrelated sites share the same entry point. With Cloudflare's implementation, for example, every ECH-protected site appears to the network under a single shared name; an observer can tell the visitor is going to a site on Cloudflare but cannot work out which one.

What is on the list

Wyden's letter singles out two services. The Department of Veterans Affairs' online suicide-prevention service, veteranscrisisline.net, is hosted on Amazon Web Services, which according to the letter does not currently support ECH. The FBI tip portal, tips.fbi.gov, runs on Cloudflare, which does support ECH, but the bureau has not turned the feature on. Wyden stressed that for federal domains on a CDN that supports ECH, such as Cloudflare, protection requires only a configuration update.

Of the 350 addresses, 191, or 54.6 percent, are diplomatic: 174 embassy sites, three consulates and 14 missions, most of them to international bodies such as NATO and the UN. Another 53 are subdomains of the Bureau of Indian Education's bie.edu domain and appear to be individual school sites, and 12 are test, training or staging servers. The remaining 94 include the DHS inspector general's complaint line, the Justice Department's civil rights reporting portal, the intelligence community's job application site, a USCIS tip form, the State Department's Rewards for Justice site, an NIH alcohol treatment referral site, a CDC doxy-PEP site, several federal HIV information sites and ICE's detainee locator.

According to Cloudflare's documentation, ECH is on by default for Free plans, while customers on other plans must enable it themselves. For the FBI, the fix is a single setting. For the VA, it is different: if Amazon's CDN does not offer ECH, the agency would have to change providers or wait.

Contract requirement and ECH's limits

Wyden's second request, making ECH support a federal contracting condition, is not without friction either. A procurement rule written today could, in practice, favor a very small group of providers until others catch up. That may be intended as leverage on Amazon and its rivals, but in the short term it could work more as a market lever than as a security fix.

ECH also has limits of its own. The protocol specification warns that the destination can still leak through unencrypted DNS queries or through the server's IP address. Google, when it added system-wide ECH support to Android 17 in August, noted that the feature works together with private DNS to hide visited domains. Agencies can turn ECH on at their end, but they cannot make a veteran on a home broadband connection use encrypted DNS; in that case someone watching the network may still see the visit. ECH likewise offers no protection against server breaches.

The Russia problem and an earlier push

The international reach of the list creates a separate problem. It includes embassy sites such as ru.usembassy.gov, by.usembassy.gov, cn.usembassy.gov and ir.usembassy.gov, where users may be connecting from comparatively hostile networks. Russia has blocked Cloudflare's ECH since November 2024; the regulator Roskomnadzor said at the time that using the feature violated Russian law. Russian providers block connections that carry both the ECH extension and Cloudflare's shared outer name, which left Cloudflare customers choosing between turning ECH off and moving to a local CDN. For an embassy page, enabling ECH could make the site unreachable in the very country where hiding the site name matters most. For now, skipping ECH on those addresses looks like the only realistic option.

The issue is not new for Wyden. In an October 2018 letter to DHS's Chris Krebs, he urged agencies to adopt encrypted DNS and Encrypted SNI, the predecessor of ECH, and asked DHS to work with GSA to make ESNI a requirement for CDN providers selling to the government. He called it a logical next step after DHS's 2017 HTTPS directive, BOD 18-01.