Democratic Senator Ron Wyden of Oregon is calling on the Trump administration to address a security vulnerability that could allow foreign entities to monitor visits to sensitive U.S. government websites.
In a recent communication, Wyden urged the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to mandate the adoption of a security measure that conceals the identity of websites visited by users. This measure, termed Encrypted Client Hello, safeguards the website name during the initial connection between a user’s browser and the site.
Encryption Deficiency
Wyden’s team identified 350 federal websites lacking this encryption feature. These sites encompass intelligence job applications, immigration services, health resources, and U.S. diplomatic platforms worldwide.
Wyden warned that the exposure could help foreign adversaries identify veterans seeking mental health assistance and people contacting the FBI, as stated in his letter to CISA and OMB.
He also requested that OMB require cloud and network providers to support this technology as a condition for federal contracts, setting a response deadline of November 20.
At-Risk Services
Similarly, the FBI’s tips portal, tips.fbi.gov, uses Cloudflare, a provider capable of supporting Encrypted Client Hello, but the feature remains inactive, potentially compromising the anonymity of those contacting the bureau.
Other affected sites include the DHS inspector general’s complaint hotline (hotline.oig.dhs.gov), the intelligence community’s recruitment portal (apply.intelligencecareers.gov), and federal HIV information sites such as hivinfo.nih.gov and clinicalinfo.hiv.gov.
Wyden emphasized that the government can address these vulnerabilities using existing technology supported by major browsers and already deployed on millions of websites. For agencies whose providers support Encrypted Client Hello, activation may be as straightforward as adjusting a setting.
Supported by major browsers and some infrastructure providers since 2023, Encrypted Client Hello has been identified as a critical security measure. Wyden’s team tested federal websites and found them lacking this encryption, which is essential for protecting sensitive interactions. Testing involved using third-party network providers to verify if the protocol effectively concealed the specific websites being visited.
Wyden also highlighted the recent breach of the FBI’s job portal by a criminal hacking group. Additionally, the Justice Department’s civil rights reporting site (civilrights.justice.gov) is among those lacking the protocol. Testing revealed that the protection was only effective on sites using Cloudflare’s free service tier.
