350 US Federal Sites Expose Visitor Names to Network Snoops

The HTTPS blind spot leaving visitors exposed

While HTTPS protects what users read and submit, it still broadcasts the exact website they contact.

The padlock icon in a browser confirms submitted forms and passwords are safe from eavesdroppers, but it never hid the destination host itself. During the opening TLS handshake, browsers broadcast the targeted domain in a clear-text field called Server Name Indication (SNI). Any observer along the wire—from coffee shop Wi-Fi snoops to internet service providers—can log that a device connected to a specific address.

US Senator Ron Wyden warned federal cybersecurity leaders that this gap leaves citizens exposed when reaching out to high-stakes portals. In a letter to CISA and the federal CIO, Wyden attached a list of 350 executive branch web addresses that fail to deploy Encrypted Client Hello (ECH).

The list includes the Veterans Crisis Line (veteranscrisisline.net), the FBI's tips portal (tips.fbi.gov), civil rights complaint forms at the Justice Department, and whistleblower desks. Someone seeking suicide intervention or reporting a crime broadcasts that visit to their network carrier before sending a single byte of data.

Cloud hurdles and configuration neglect

Resolving the leak is a trivial dashboard switch for some agencies, but requires provider overhauls for others.

ECH works by routing traffic through a content delivery network (CDN) where thousands of sites share an outer front door, hiding individual hostnames behind a single provider address.

For Cloudflare-hosted agencies like the FBI, closing the hole requires almost zero effort. Free Cloudflare tiers enable ECH by default, but enterprise and government customers must opt in manually. The bureau simply has not flipped the switch. Meanwhile, institutions tracking physical and digital threats—much like the surveillance debates surrounding how Proton mirrors Flock camera maps—face growing public scrutiny over basic network hygiene.

The Veterans Crisis Line faces a harder obstacle because it sits on Amazon Web Services, whose CDN architecture currently lacks native ECH support. Wyden has asked CISA and the OMB to mandate ECH across all federal sites and turn support into a mandatory procurement condition, a move that could lock AWS out of federal hosting contracts until it updates its stack.

Geopolitics complicates the encryption rollout

Over half of the exposed addresses belong to foreign missions operating in hostile digital environments.

More than 190 of the exposed domains belong to diplomatic outposts, including embassies in Russia, Belarus, and China. Mandating ECH across every federal property triggers an immediate diplomatic paradox.

Russian communications regulator Roskomnadzor already blocks web traffic that uses Cloudflare's ECH. If the US State Department enables the protocol on ru.usembassy.gov, visitors inside Russia lose access to the embassy site entirely. Diplomatic IT teams face a difficult trade-off between masking user metadata and keeping consular portals reachable.

Furthermore, ECH only succeeds when end users pair it with encrypted DNS. If a visitor's home router still issues plain-text DNS lookups, internet providers can log the destination anyway.

What it means for users

For users across the US, UK, and EU, visiting unpatched federal reporting desks on untrusted connections remains a privacy risk unless your device routes through encrypted DNS (such as DNS-over-HTTPS). Modern browsers support ECH automatically, but protection requires server-side adoption.

CISA and OMB have until November 20, 2026, to respond with a remediation roadmap. Until agencies patch their configurations, anyone reaching out to federal tip lines or whistleblower desks should consider browsing through a trusted VPN.

The federal push for total web encryption remains incomplete as long as handshake metadata sits in the clear. Closing that opening requires agencies to audit their CDN dashboards, vendors to match modern standards, and diplomats to balance privacy against foreign censorship.