FBI Tip Line and Veterans Crisis Site Among 350 Federal Web Addresses Exposing Visitors to Web Spies, Senator Warns
follow us
Add us as a preferred source on Google
- Senator Ron Wyden wants CISA and OMB to require Encrypted Client Hello on federal websites and make it a condition of the federal contract
- Its list of 350 addresses hosted on non-ECH CDNs includes the FBI information portal, the VA crisis line, and hotlines for whistleblowers and civil rights complaints.
- ECH hides site names only along with encrypted DNS, does nothing to address server violations, and is already blocked in Russia, where some listed embassy pages are targeted.
U.S. Sen. Ron Wyden (D-Ore.) wants the federal government to turn on a privacy feature that major Web browsers have supported for three years, warning that hundreds of agency Web addresses still broadcast the name of the site each visitor uses to anyone watching the Web along the way.
In a letter to CISA Acting Director Nick Andersen and Federal Deputy Chief Information Officer Thomas Flagg, Wyden called on the two agencies to require Encrypted Client Hello (ECH) on all federal websites and to make ECH support a condition for network and cloud providers seeking federal contracts.
The letter attaches a list of 350 executive branch web addresses that use content delivery networks (CDN) but do not use ECH, while requesting an unclassified response and an action plan by November 20, 2026.
Latest videos ofTechnologyRadar
The only thing HTTPS leaves bare is the gap addressed here.
Almost all federal sites now encrypt the pages people read and the forms they submit. Standard HTTPS does not hide the hostname. When a browser opens a secure connection, it announces the site it wants in a field called Server Name Indication, in plain text, before encryption begins.
Therefore, an Internet provider, a hostile Wi-Fi network, or a compromised telecom operator can record that a connection went to tips.fbi.gov without reading a word of the notice.
ECH encrypts that part of the handshake. It works best behind a large CDN, where thousands of unrelated sites share the same front door. Cloudflare’s implementation, for example, presents each ECH-protected site to the network under a shared name, so an observer can know that a visitor is arriving at a Cloudflare-hosted site, but not which one.
Wyden’s letter highlights two services. The Department of Veterans Affairs’ online suicide prevention service at veteranscrisisline.net is hosted on Amazon Web Services, which, according to the letter, does not currently support ECH. The FBI tips portal at tips.fbi.gov runs on Cloudflare, which does, but the bureau has not yet activated it, as Wyden noted, stating: “For federal domains that use a CDN provider with ECH support, such as Cloudflare, activating domain protection simply requires a configuration update.”
191 of the 350 addresses, or 54.6%, are diplomatic: 174 embassies, three consulates and 14 missions, mostly to international organizations such as NATO and the UN. Another 53 are subdomains of bie.edu, the domain of the Indian Bureau of Education, which appear to be individual school sites. Another 12 are testing, training or preparation hosts, including several user acceptance testing subdomains for the Department of Education’s debt services.
That leaves 94 addresses outside of those groups, and the most concerning entries are there; They include the DHS inspector general complaint hotline, the Department of Justice’s civil rights reporting portal, the intelligence community’s job application site, a USCIS tip form, the State Department’s Rewards for Justice site, an NIH alcohol treatment navigator, a CDC doxy-PEP site, several federal HIV information sites, and the ICE detainee locator.
Cloudflare documentation says that ECH is enabled by default in free zones, while customers with other plans must activate it themselves. This is consistent with the spokesperson’s conclusion: a paying government customer has to opt-in. For the FBI, the solution really is an environment.
For the VA, it is not. If Amazon’s CDN does not offer ECH, the agency would have to switch providers or wait. This is where Wyden’s second request, making ECH support a condition of federal contracts, gets complicated.
A procurement rule written today would, in practice, favor a very small group of suppliers until others catch up. That may be the intention, as it puts pressure on Amazon and its rivals, but it may be both a market lever and a security solution, at least in the short term.
However, ECH has its limitations: the protocol specification itself warns that the destination can still be leaked through plaintext DNS lookups or the server’s IP address. Google followed suit when Android 17 added system-wide ECH in August, saying the feature works “in conjunction with private DNS to hide the domain names you visit.”
To reiterate, agencies can enable ECH on their end, but they cannot make a home broadband veteran use encrypted DNS, thus leaving the door open to exploitation by someone snooping around the network.
A bigger problem is also international coverage. Many of the featured URLs are embassies such as ru.usembassy.gov, by.usembassy.gov, cn.usembassy.gov, and ir.usembassy.gov, all of which likely have users connecting from relatively hostile networks.
Russia has been blocking Cloudflare’s ECH since November 2024, with regulator Roskomnadzor stating at the time that its use violates Russian law. Russian providers block connections that carry both an ECH extension and Cloudflare’s external shared name, leaving Cloudflare customers choosing between disabling ECH and moving to a domestic CDN.
For an embassy page, enabling ECH could mean swapping a visible hostname for an inaccessible site in the country where the hostname is most important, making it a difficult trade-off with only one real solution: bypass ECH for now.
None of this is new territory for Wyden. In October 2018, he wrote to DHS’s Chris Krebs urging agencies to adopt encrypted DNS and encrypted SNI, the predecessor to ECH, and asking DHS to work with GSA to make ESNI a condition for CDN providers to sell to the government.
He called it “the next logical step” after DHS’s 2017 HTTPS directive, BOD 18-01. The 2026 letter cites the same directive and describes its requests as “logical next steps.” His record in these letters is more mixed than hopeless. A 2018 HTTPS letter to the Pentagon was followed by a Department of Defense plan to protect its websites.
The client side is ready: Most major browsers support ECH as of October 2023, according to the letter, and Android 17 now enforces it system-wide. The FBI’s solution is cheap and overdue. But ECH limits what a passive spy learns rather than making a visit invisible, and whether this request lasts longer than the last one may depend less on CISA and OMB than on whether Amazon and others join Cloudflare.
Follow TechRadar on Google News and add us as a preferred source to receive news, reviews and opinions from our experts in your feeds.
Post Comment