US Government Requires HTTPS

The Obama White House has issued a memorandum telling all US government agencies they must use HTTPS for all websites and web communication. A summary document online, titled “The HTTPS-Only Standard” is a web-friendly version of the White House Office of Management and Budget memo M-15-13, “Policy to Require Secure Connections across Federal Websites and Web Services.”

The document states the requirement that “all publicly accessible Federal websites and web services only provide service through a secure connection.” According to the doc, Hypertext Transfer Protocol Secure (HTTPS) is the “strongest privacy and integrity protection currently available for public web connections,” and it is therefore the protocol of choice for encrypted sessions.

Although many modern websites have adopted HTTPS as the standard web protocol, a vast number of sites still operate on un-encrypted, plain old HTTP. The US federal government has such a huge collection of sites that establishing HTTPS as a minimum standard for privacy could have a ripple effect through the rest of the web. The memo states the principle that “All browsing activity should be considered private and sensitive,” which privacy advocates in the US and abroad will welcome.

Although this plan has reportedly been in the works for several months, the announcement might have been timed to appear proactive in the wake of reports about security breaches on government sites, such as the recent massive attack on the US Office of Personnel Management. The NSA scandals have also created a need for the White House to make a statement affirming a general right for privacy, although recent proceedings in the congress and courtroom indicate the administration isn’t giving up on its interest in Internet surveillance.