Cloud and network providers that sell to federal agencies could have to support a privacy protection called Encrypted Client Hello to keep qualifying for federal contracts, if the executive branch follows a request Sen. Ron Wyden made this week. In a letter to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget, Wyden urged the government to upgrade hundreds of federal websites that he says are "currently vulnerable to surveillance," and attached a non-exhaustive list of 350 federal web addresses that lack the protection.
The Oregon Democrat sent the letter on Oct. 19, 2026, to CISA acting director Nick Andersen and deputy federal chief information officer Thomas Flagg. Beyond asking agencies to turn on the technology, he asked OMB, working with CISA and the Office of the National Cyber Director, to require that cloud and network providers support it to qualify for federal contracts, Nextgov/FCW reported. He requested responses by Nov. 20.
What Encrypted Client Hello Hides That HTTPS Does Not
Federal websites generally encrypt the information people read or submit. What standard web encryption does not protect, according to Wyden's office, is the name of the website a user visits, such as "reportfraud.ftc.gov." Anyone watching network traffic can read that name even when the page contents stay encrypted.
Encrypted Client Hello, or ECH, closes that gap by protecting the website name when a user's browser connects to a site. Nextgov/FCW reports that major browsers and some web infrastructure providers have supported it since 2023.
"As data travels across the internet, hackers and foreign actors monitoring network connections can easily see these exposed website names," Wyden wrote. "This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies."
Wyden also argued that turning ECH on would not weaken agency defenses. "Modern federal zero trust cybersecurity practices rely on protective software installed directly on agency devices, so enabling [Encrypted Client Hello] would strictly improve the cybersecurity of federal networks," he wrote, as quoted by Nextgov/FCW.
Which of the 350 Federal Addresses Wyden Singled Out
The press release says the exposed sites include dozens of U.S. embassies, the FBI online tipline and the Department of Veterans Affairs online suicide prevention hotline. The release's subhead also names FBI and FTC tiplines among the sites it describes as vulnerable to spying.
Nextgov/FCW, which reviewed the letter, reported that the list also includes:
- hotline.oig.dhs.gov, the DHS inspector general's complaint hotline;
- civilrights.justice.gov, the Justice Department's civil rights reporting portal;
- apply.intelligencecareers.gov, an intelligence community recruitment site; and
- federal HIV information sites, including hivinfo.nih.gov and clinicalinfo.hiv.gov.
The outlet also reported that the list covers sites for immigration services and U.S. diplomatic websites around the world.
The letter singles out two services in detail. The VA's Veterans Crisis Line platform runs on Amazon Web Services, which does not currently support ECH for the site, according to the letter. Wyden warned that the exposure could help foreign adversaries identify veterans seeking mental health help. The FBI's tips.fbi.gov site uses Cloudflare, a provider that supports ECH, but the portal has not enabled it, the senator said.
Why the Free Cloudflare Tier Matters in Wyden's Testing
To build the list, Wyden's staff tested federal web addresses through third-party network providers to see whether ECH hid which specific sites were being visited, a spokesperson told Nextgov/FCW. The protection only appeared to work on sites relying on Cloudflare's free service tier, the spokesperson added.
That finding bears on the procurement argument. If the protection works only where a provider has built and switched it on, an agency that wants it may depend on its hosting or content delivery vendor to offer it. Wyden said that for agencies whose providers already support ECH, enabling it can be as simple as changing a setting. For agencies whose providers do not support it, a setting may not be enough, which fits the letter's request that OMB make provider support a condition of federal work.
Nextgov/FCW noted that the letter does not establish that adversaries have tracked visitors to any of the listed addresses. Wyden's case rests on what an observer on the network could see, not on a documented incident. Nextgov/FCW said it had requested comment from CISA and OMB.
Wyden's Second Push on Federal Traffic Privacy Since September
The letter follows Wyden's September call for the National Security Agency to update its advice about virtual private networks. A Congressional Research Service analysis requested by his office at the time warned that foreign intelligence services with broad visibility into internet traffic could potentially connect VPN users to websites by comparing traffic patterns, according to Nextgov/FCW.
Both efforts target metadata rather than content: what an observer can learn about who is talking to whom even when the conversation itself is encrypted. Nextgov/FCW also noted that the possible FBI exposure comes after a prolific criminal hacker group recently stole troves of sensitive employee information tied to the bureau's jobs portal.
What It Means for Contractors
The letter is a request, not a rule. Wyden asked for responses by Nov. 20, and neither the press release nor Nextgov/FCW's account describes how a contract requirement would be written or when it could take effect. Still, the ask is aimed directly at the vendors that host federal web properties.
- Cloud and content delivery providers. The letter names AWS as not currently supporting ECH for the VA crisis line and Cloudflare as supporting it. A provider that cannot offer ECH would be exposed if OMB adopts Wyden's proposed qualification condition.
- Web hosting and operations contractors. Firms that run agency sites on providers that already support ECH may be asked to turn it on. By Wyden's account, that can be as simple as changing a setting, and the FBI tip portal is his example of a site on a supporting provider that has not enabled it.
- Integrators supporting sensitive portals. Tiplines, inspector general hotlines, crisis services, civil rights reporting and recruiting sites are among the examples in the press release and the Nextgov/FCW account. Contractors maintaining those systems may see the earliest questions from agency customers.
- Zero trust programs. Wyden argues ECH does not conflict with zero trust practices that rely on software installed on agency devices. Vendors selling network monitoring into agencies may want to check how their tools handle encrypted site names.
Contractors with federal web hosting work can check now whether their platforms support ECH and whether it is enabled on the sites they run, before any customer asks.
