Wyden presses CISA to mandate ECH on federal websites
The senator attached a list of 350 federal web addresses without Encrypted Client Hello and asked for a response plan by November 20, 2026.
US Senator Ron Wyden has asked the Cybersecurity and Infrastructure Security Agency and the federal chief information officer's office to require Encrypted Client Hello (ECH) on federal websites and to make ECH support a condition for cloud and network vendors bidding for federal contracts. According to techradar.com, the letter was addressed to CISA acting director Nick Andersen and deputy federal CIO Thomas Flagg.
Attached to the letter is a list of 350 executive branch web addresses that use content delivery networks but do not use ECH. Wyden asked for an unclassified response and an action plan by November 20, 2026.
Diplomatic sites dominate the list
Of the 350 addresses, 191 are diplomatic — 174 embassy sites, three consulates and 14 missions — and 53 are subdomains of bie.edu. The list also includes tips.fbi.gov, which runs on Cloudflare and could enable ECH through a configuration change, according to the letter, and veteranscrisisline.net, hosted on Amazon Web Services, which the letter says does not currently support ECH.
Cloudflare's documentation states that ECH is enabled by default on Free zones but must be switched on by customers on other plans.
ECH has been supported by major web browsers for three years, according to the article. Standard HTTPS does not hide the hostname, which browsers send in plain text via Server Name Indication before encryption begins.
Quick answers
What is Ron Wyden asking CISA to do?
He asked CISA and the federal CIO's office to require Encrypted Client Hello on federal websites and to make ECH support a condition for cloud and network vendors seeking federal contracts.
When does Wyden want a response?
The letter requests an unclassified response and action plan by November 20, 2026.
Which federal sites are named in the letter?
The attached list of 350 addresses includes tips.fbi.gov, veteranscrisisline.net, 191 diplomatic addresses and 53 subdomains of bie.edu.