# Wyden Urges Agencies to Require ECH

Sen. Ron Wyden urged CISA and OMB to require Encrypted Client Hello (ECH) on public-facing federal websites and interagency web systems, and proposed making ECH support a condition of federal contracts for commercial cloud and network providers. Wyden’s staff identified at least 350 executive-branch web addresses without ECH, including sensitive tip and crisis-support services. Agencies were asked to provide an action plan by **November 20, 2026 (31 days from October 20)**. The proposed requirement has not been established as a current contract obligation; the signals identify no solicitation, award, funding amount, or implementation deadline for vendors.

- Cloud and network contractors can assess ECH support across their services and identify implementation readiness, since the proposal could lead to new contract conditions.
- CISA and OMB’s requested agency action plans may clarify whether and how agencies intend to address the identified exposure; procurement teams should distinguish any subsequent agency decisions from Wyden’s proposal.
- AWS and Cloudflare are identified as providers for federal services cited in the reporting, making the issue relevant to providers supporting federal websites and sensitive online services.

**Jurisdictions:** federal
**Industries:** Information Technology
**Topics:** Cybersecurity, Digital Infrastructure, Regulatory Compliance
**Published:** October 19, 2026

### Government Entities
- Cybersecurity and Infrastructure Security Agency (CISA)
- Office of Management and Budget (OMB)
- Department of Veterans Affairs (VA)
- Federal Bureau of Investigation (FBI)

### Vendors
- Amazon Web Services (AWS) (Cloud service and website hosting provider for the Veterans Crisis Line platform)
- Cloudflare (Network service provider for the FBI tips portal)

### Key Quotes
> This visibility could lead to malicious eavesdroppers identifying whistleblowers, profiling cleared federal personnel, tracking Americans seeking crisis support, and mapping interactions between agencies.
> — Ron Wyden, U.S. Senator

### Sources
- [Senator warns hundreds of federal web addresses may lack key spying protection - Nextgov/FCW](https://www.nextgov.com/cybersecurity/2026/10/senator-warns-hundreds-federal-web-addresses-may-lack-key-spying-protection/416660) - Nextgov/FCW
- [Wyden seeks adoption of encryption tech at hundreds of federal agencies to protect visitors’ sensitive traffic | CyberScoop](https://cyberscoop.com/wyden-urges-federal-adoption-encrypted-client-hello) - CyberScoop
- [Wyden Flags Potential Online Surveillance Risks Across Hundreds of Federal Websites – MeriTalk](https://www.meritalk.com/articles/wyden-flags-potential-online-surveillance-risks-across-hundreds-of-federal-websites) - MeriTalk