Federal Websites Protect Your Message. The Destination May Be Less Discreet.

Senator Ron Wyden says his staff identified 350 federal web addresses missing a protection that can hide which website a person is visiting. The list includes FBI tips, intelligence recruitment and other sensitive government services, Defense One reported October 19. The contents people read or submit are generally encrypted. The name of the site can still be visible to someone monitoring the traffic.

The message gets confidentiality. The destination gets to be an interesting little fact about your afternoon.

This is not a report that 350 sites were hacked or that spies have been caught tracking their visitors. Wyden’s letter establishes neither. It identifies an exposure that makes the government’s invitation to use sensitive online services rather less reassuring than it should be.

Some destinations communicate quite a bit before anyone reads the message. An intelligence-agency recruitment site is not merely a collection of tasteful federal typography. The fact that somebody visited it can be information worth protecting in its own right.

The relevant standard is called Encrypted Client Hello. Yes, Hello. We have built a digital world in which the greeting requires an additional security protocol. Your message can be wearing full protective equipment while the introduction wanders ahead waving.

Major browsers and some infrastructure providers have supported the technology since 2023. According to Wyden, the FBI tip portal uses a provider that supports it but has not enabled it. Some other providers do not currently offer the protection for the listed services. That makes the remedy more complicated than demanding that every agency press the same button.

For one category, the government needs an available protection turned on. For another, it needs its supplier to provide the protection. Two different procurement problems, united by the charming fact that neither is the responsibility of the person trying to send the FBI a tip.

I would like that person to concentrate on the tip. They should not need to begin by auditing the federal government’s implementation of a browser handshake.

The institution asking for sensitive information ought to have handled the introduction. That seems a reasonable division of labour. One party has something important to communicate; the other has a cybersecurity apparatus and purchasing contracts. Guess which one should be checking the feature list.

Wyden has asked the Office of Management and Budget and the Cybersecurity and Infrastructure Security Agency to require the protection. He also wants support for it to become a condition for cloud and network companies seeking federal contracts. His requested response date is November 20, still ahead. These are demands in a letter, not an adopted mandate or a deadline the agencies have already missed.

But there is a very specific improvement hiding in that request. Instead of discovering afterward which supplier makes a useful privacy feature available, the government could ask before agreeing to buy the service.

Revolutionary. Put the requirement in the requirements.

It would spoil some of the suspense, admittedly. Procurement could become a dreary exercise in obtaining the thing the agency actually needs rather than a long-running reveal of which protections came with the selected package. I’m prepared to sacrifice the entertainment.

This is not a promise that one encryption feature makes every visitor anonymous or every site invulnerable. The information inside a connection and the identifying details around it are different security problems. Protecting one does not authorize officials to stop thinking about the other.

For fuck’s sake, the government is recruiting intelligence personnel. It should understand that useful intelligence is not confined to the paragraph marked secret. Sometimes the important fact is who is making contact with whom.

Wyden’s office found that the protection appeared to work on tested sites using one provider’s free tier. There is a particularly American embarrassment in asking whether sensitive federal services have caught up with a feature available on the free plan.

The government doesn’t need another stirring speech about zero trust here. It needs to establish what its services reveal before anybody has submitted a word.

Start with hello. Apparently we weren’t finished securing that part.