Federal Government Approves HTTPS-Only Standard for All Federal Websites

On Tuesday the White House Office of Management and Budget announced the adoption of the HTTPS-Only standard for all federal websites. OTI endorsed the proposed standard last month, and we are thrilled that the White House’s Chief Information Officer and the OMB decided to take this decisive step to bring the security of all of the federal government’s Web-based services up to par with the best practices being implemented by the private sector. We hope that all state and local governments will follow the White House’s lead, to ensure that Americans can conduct business with every level of government with the same degree of security that will soon be offered by all federal websites.

Under the new policy, all federal websites will be required to provide mandatory HTTPS connectivity to all visitors by December 31, 2016. Requiring the use of the more secure HTTPS protocol will ensure that information will be transmitted to or from federal websites through properly encrypted and authenticated communication channels.

The new mandate will greatly enhance the security and privacy of millions of Americans who use government websites to research and interact with programs such as Social Security, Medicare, the Veteran’s Administration and the many other federal services that provide and solicit potentially-sensitive information. The HTTPS-Only standard provides significantly more robust assurances that information sent to and received from federal websites will be kept private in transit, protected from eavesdropping, misrouting, and manipulation as it travels across the public Internet.

This week’s announcement is a significant step forward for the security of the Internet — but it is only the first step. While Americans conduct many potentially-sensitive transactions with the Federal government, they conduct at least as much private business with their state and local governments. Since the new standard applies only to federal sites, it now falls to state and local governments to enact similar requirements. Indeed, the White House’s announcement presents an unprecedented chance to build a movement to bring the security of all U.S. websites (government and non-government alike) up to industry standards. We should harness the current momentum behind the HTTPS-only standard, and take additional steps to ensure that Americans are not exposed to unacceptably high levels of risk.