Senator warns hundreds of federal web addresses may lack key spying protection

Sen. Ron Wyden, D-Ore., is urging the Trump administration to close an encryption gap that could let foreign adversaries track visits to sensitive government websites, including the FBI’s tip portal and a veterans crisis line, according to a letter sent to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget on Monday and first seen by Nextgov/FCW.

Wyden asked CISA and OMB to require that agencies implement a web security standard that hides the name of the website someone is visiting. The protocol, known as Encrypted Client Hello, protects the website name when a user’s browser connects to a site and has been supported by major browsers and some web infrastructure providers since 2023.

Wyden’s office identified 350 federal web addresses that lack the encryption specification. They include sites that facilitate intelligence community job applications, immigration services, health information and U.S. diplomatic websites around the world.

“This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies,” Wyden wrote to CISA acting director Nick Andersen and deputy federal chief information officer Thomas Flagg. 

He also asked OMB, working with CISA and the Office of the National Cyber Director, to require that cloud and network providers support the technology to qualify for federal contracts. He requested responses by Nov. 20.

Nextgov/FCW has requested comments from CISA and OMB.

Federal websites generally encrypt the information people read or submit, though hackers can still learn which sites they visit by monitoring their internet traffic.

The letter singles out two services whose visitors could be particularly vulnerable.

The Department of Veterans Affairs’ Veterans Crisis Line platform uses Amazon Web Services, which does not currently support ECH for the site, according to the letter. Wyden warned that the exposure could help foreign adversaries identify veterans seeking mental health assistance. Additionally, the FBI’s tips.fbi.gov site uses Cloudflare, a provider that supports ECH, but the portal has not enabled it, the senator added, arguing the current arrangement could put people contacting the bureau at risk of identification.

The possible FBI exposure also comes after a prolific criminal hacker group recently stole troves of sensitive employee information tied to the bureau’s jobs portal. 

The list of sites without the protocol also includes hotline.oig.dhs.gov, the DHS inspector general’s complaint hotline; civilrights.justice.gov, the Justice Department’s civil rights reporting portal; and apply.intelligencecareers.gov, an intelligence community recruitment site. Federal HIV information sites, including hivinfo.nih.gov and clinicalinfo.hiv.gov, are also listed.

To craft the list, Wyden’s staffers tested federal web addresses using third-party network providers to see if ECH successfully hid which specific websites were being visited, a spokesperson told Nextgov/FCW. The protection only appeared to work on sites relying on Cloudflare’s free service tier, the spokesperson added.

The letter does not establish that adversaries have tracked visitors to any of the listed addresses. 

Wyden argued the government can close these gaps using technology already supported by major browsers and deployed across millions of websites. For agencies whose providers support ECH, enabling it can be as simple as changing a setting, he said.

“Modern federal zero trust cybersecurity practices rely on protective software installed directly on agency devices, so enabling [Encrypted Client Hello] would strictly improve the cybersecurity of federal networks,” Wyden wrote.

The effort follows his September call for NSA to update its advice about virtual private networks. A Congressional Research Service analysis requested by his office at the time warned that foreign intelligence services with broad visibility into internet traffic could potentially connect VPN users to websites by comparing traffic patterns.