In a report by Nextgov, Sen. Ron Wyden is urging the Trump administration to address a critical encryption vulnerability that could expose sensitive government website visits to foreign adversaries. The senator highlighted concerns that this gap could allow for the tracking of individuals accessing vital services and information.
Wyden sent a letter to the Cybersecurity and Infrastructure Security Agency and the Office of Management and Budget, requesting they mandate the use of Encrypted Client Hello (ECH) across federal agencies. This protocol encrypts the website name during a user's connection, preventing adversaries from identifying which specific sites are being visited. Wyden's office identified over 350 federal web addresses lacking this security measure, including the FBI's tip portal, a veterans crisis line, intelligence community job application sites, and U.S. diplomatic websites. The senator warned that this exposure could enable malicious actors to identify whistleblowers, profile federal personnel, track individuals seeking crisis support, and map inter-agency interactions. He specifically pointed to the Veterans Affairs' Veterans Crisis Line and the FBI's tips.fbi.gov as particularly vulnerable. Wyden also proposed that cloud and network providers be required to support ECH to qualify for federal contracts. The letter emphasizes that enabling ECH is a crucial step in modernizing federal cybersecurity practices and aligning with zero trust principles.
Source: Nextgov
