US Senator Presses Federal Agencies to Hide Which Websites Visitors Use, Citing Risks to Whistleblowers and Crisis Callers

US Senator Ron Wyden has asked the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget to move hundreds of federal agency websites to a technology called Encrypted Client Hello (ECH). ECH protects the name of the website a person is visiting. His office identified at least 350 sites that do not use it.

Wyden's point is that almost all federal websites are encrypted, but standard web encryption does not hide some website names. He used reportfraud.ftc.gov as an example. He warned that hackers and foreign actors watching network connections could see these exposed names, which could help them identify whistleblowers, profile cleared federal personnel, track Americans seeking crisis support, and map interactions between agencies.

ECH works especially well with content delivery networks (CDNs), which connect hundreds of thousands of websites to the internet. With ECH, someone intercepting traffic can see the network delivering the content but not the specific site. Wyden said an FBI tipline supports ECH but has not enabled it, and a Department of Veterans Affairs online suicide prevention hotline is not covered because Amazon does not support it. Without ECH, he warned, foreign adversaries might be able to identify someone submitting crime tips to the FBI. He made two recommendations to the leaders of CISA and the OMB.