Cybersecurity Policy Report, Federal Websites Should Use Tech Tool to Protect Americans’ Privacy, Wyden Says, (Oct 20, 2026)
Technology that hides the names of websites individuals visit should be enabled by federal government websites to protect website visitors from hackers and foreign adversaries, according to Sen. Ron Wyden (D., Ore.).
In a letter sent yesterday to the Cybersecurity and Infrastructure Security Agency and Office of Management and Budget, Sen. Wyden noted that federal government websites “nearly universally encrypt website data, protecting the contents of web pages from prying eyes.”
“However, standard web encryption does not protect website names such as ‘reportfraud.ftc.gov.’ As data travels across the internet, hackers and foreign actors monitoring network connections can easily see these exposed website names,” he said.
“This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies,” he added.
Sen. Wyden recommended that CISA and OMB require federally managed websites to use Encrypted Client Hello (ECH), a cybersecurity technology that hides the names of websites visited by individuals.
ECH “is particularly effective when used by major Content Delivery Networks (CDNs), which connect hundreds of thousands of different websites to the internet. When ECH is used on a website delivered by a CDN, anyone intercepting a user's web traffic can see which network is delivering the content, but cannot directly identify the specific site visited among the many websites hosted on the same CDN,” he explained.
“Today, many federal websites rely on CDNs but do not benefit from the protections of ECH,” he said. He included in his letter “a non-exhaustive list” of 350 executive branch websites that use CDN infrastructure without ECH protection, including an online tip line, tips.fbi.gov, that could benefit from the protections of ECH to prevent foreign adversaries from identifying Federal Bureau of Investigation tipsters.
“It is operationally feasible to close these security gaps today. Industry support is already well established; most major web browsers have supported ECH since October 2023 and Android added ECH support this August,” he said.
“ECH technology has been enabled across millions of active websites. For the federal domains using a CDN provider with ECH support, such as Cloudflare, turning on domain protection merely requires a configuration update. Furthermore, this upgrade introduces no operational downsides,” he noted.
“CISA should require that civilian federal agencies enable the protections of ECH across all public-facing websites and inter-agency web systems. OMB, in coordination with the Office of the National Cyber Director and CISA, should establish support for ECH protections as a mandatory condition for commercial cloud and network vendors seeking federal contracts,” Sen. Wyden advised.
He asked CISA and OMB to “provide my office with an unclassified response and action plan detailing your progress on these steps” by Nov. 20.
MainStory: TopStory FederalLegislation DataPrivacy DataSecurity