US Senator flags 350 federal websites lacking privacy protection, urges ECH adoption
US Senator Ron Wyden has identified 350 federal web addresses, including the FBI tip portal and Veterans Crisis Line, that expose visitors’ browsing activity to network spies due to the lack of Encrypted Client Hello (ECH). He is urging agencies to adopt the standard to protect sensitive interactions, while calling on cloud providers like Amazon Web Services to support it.
Editor, Lazyfounder
TABLE OF CONTENTS
Why ECH matters for federal websites
US Senator Ron Wyden has called on federal agencies to implement Encrypted Client Hello (ECH) across government websites to prevent network observers from tracking visitors’ browsing activity. ECH encrypts the Server Name Indication (SNI) field in HTTPS connections, which currently exposes the names of websites users visit—even if the content of their interactions remains encrypted.
Wyden’s request follows his identification of 350 federal web addresses lacking ECH. These include sensitive portals such as the FBI tip line (tips.fbi.gov), the Veterans Crisis Line (veteranscrisisline.net), and whistleblower and civil rights complaint hotlines. Without ECH, entities like internet service providers, compromised telecom carriers, or malicious Wi-Fi networks can log which sites users access, such as an FBI tip portal, without accessing the content itself.
Gaps in adoption and infrastructure challenges
Wyden’s review revealed stark disparities in ECH adoption. Of the 350 unprotected addresses, 191 are diplomatic sites, including US embassies in Russia, China, Iran, and Belarus, along with consulates and missions to international organizations like NATO and the UN. Another 53 belong to the Bureau of Indian Education, representing individual school websites.
While Cloudflare supports ECH by default for free plans, agencies using its paid services—such as the FBI—must manually enable the feature. According to Wyden’s letter, activating ECH for these domains requires only a configuration update. However, Amazon Web Services (AWS), which hosts the Veterans Crisis Line, does not currently support ECH, forcing agencies to either migrate to another provider or wait for AWS to implement the feature.
The adoption of ECH also faces geopolitical hurdles. Russia began blocking Cloudflare’s ECH implementation in November 2024, citing violations of local law. This complicates efforts to secure embassy websites, as enabling ECH could render sites inaccessible in countries where privacy protections are most needed.
Agencies’ response and next steps
Wyden has directed the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) to respond with an unclassified action plan by November 20, 2026. His letter cites the 2017 DHS HTTPS directive (BOD 18-01) as precedent, framing ECH as a logical extension of existing cybersecurity policies.
Support for ECH is already widespread among major browsers, with most adopting it since October 2023. Android 17 now applies ECH system-wide, narrowing the window for passive eavesdroppers to monitor browsing activity. However, ECH does not address threats like server breaches or DNS leaks unless paired with additional encryption measures.
Why federal contractors and CDNs are involved
Wyden’s push includes a proposal to make ECH a condition of federal contracts, effectively requiring cloud providers and content delivery networks (CDNs) to support the standard. This would accelerate adoption among agencies reliant on providers like AWS, which currently lacks ECH capabilities.
Nick Andersen, acting director of CISA, and Thomas Flagg, deputy federal chief information officer, are the key officials tasked with responding to Wyden’s request. The outcome could set a precedent for how the US government balances privacy, accessibility, and geopolitical constraints in its digital infrastructure.
What this means
Lazyfounder analysis — our interpretation, not reported fact.
For founders and operators in cybersecurity, cloud services, or government contracting, Wyden’s push for ECH adoption signals a shift in federal expectations for privacy protections. Companies like Cloudflare and AWS may face pressure to prioritize ECH support, particularly if federal contracts start requiring it. Agencies currently using AWS or other non-ECH providers—such as the Veterans Affairs’ crisis line—may need to evaluate migration costs or lobby for faster implementation.
For startups working in encryption, CDNs, or compliance tools, this development highlights an opportunity to address a growing demand for ECH-enabled solutions. It also underscores the complexities of deploying privacy measures in restrictive regimes, which could influence how global products are designed. Finally, the emphasis on ECH as a contract condition suggests that federal procurement rules may soon evolve to include stricter privacy standards, potentially impacting vendors across the government supply chain.
Related on Lazyfounder
Sources
- TechRadar · 2026-10-25
FBI tip line and veterans crisis site among 350 federal web addresses exposing visitors to network spies, senator warns
This story is an original summary drafted with AI by Lazyfounder from the reporting listed above and checked by automated validation. Facts are attributed to their original publishers; sections marked as analysis are Lazyfounder's. Where a source is in another language, facts were machine-translated and quotations are reported, not reproduced. Read the original coverage via the links, and see our AI policy and corrections policy.
About the author
Editor, Lazyfounder
Tarun Mottlia edits LazyFounders, covering Indian startups, funding rounds, AI and product launches. Every story on the site is AI-assisted and checked against its cited sources before publication.
More stories by Tarun MottliaGet the LazyFounder Brief
Startup, funding and AI news in a five-minute read. Join the early-access list.
