Michael Vatis Warned Senate About National Security Gaps

By Miriam Adler · August 10, 2026

National security gaps left critical systems vulnerable to computer intrusions while agencies struggled to share data across different mandates and levels of secrecy.

On March 1, 2000, Michael A. Vatis sat before the Senate Armed Services Committee. He was the Director of the National Infrastructure Protection Center (NIPC), a unit tasked with a mission that, at the time, was still being defined in real-time: the protection of computer systems and information systems critical to the United States. Vatis was appearing before the Subcommittee on Emerging Threats and Capabilities, a venue designed to interrogate the gaps in national security before those gaps could be exploited.

Emerging Threats and Capabilities

We do not have the full transcript of Vatis's words, but the file's catalogue entry records the scope of his testimony. According to the National Security Archive's description, Vatis provided the subcommittee with a "year 2000 overview of the organization." This was a snapshot of an agency in its infancy, attempting to codify the rules of engagement for a digital battlefield that lacked a physical map.

The catalogue entry notes that Vatis's statement included a "description of the source of cyber threats" and an "account of interagency cooperation." In the government's lexicon, interagency cooperation is often a polite term for the struggle to share data between departments that operate under different mandates and different levels of secrecy. For the NIPC, this cooperation was the primary mechanism for identifying who was knocking on the door of the nation's critical systems.

Beyond the organizational chart, the record describes Vatis providing a "review of several incidents and investigations." While the specific targets and perpetrators of these investigations are not listed in the archival description, they served as the evidentiary basis for Vatis's final point: the "challenges in combating computer intrusions."

Document imagery from nsarchive.gwu.edu From the files: nsarchive.gwu.edu

PDD 63 and the FBI

To understand the position Vatis held in 2000, one has to look back to 1998. The public record indicates that the NIPC was founded by President Bill Clinton via Presidential Decision Directive 63. The directive established the center as a branch of the FBI, placing the early defense of the nation's digital arteries under the jurisdiction of federal law enforcement.

This alignment suggested a specific philosophy of cyber defense at the turn of the century: intrusions were viewed primarily as crimes to be investigated and prosecuted. The FBI's role was to track the intruder, gather evidence, and make an arrest. However, the very existence of the Subcommittee on Emerging Threats and Capabilities suggests that the government was beginning to realize that some intrusions were not merely criminal acts, but strategic operations conducted by foreign powers.

Computer Intrusions in 2000

The Vatis testimony did not exist in a vacuum. Other records from the same period illustrate a government grappling with the volatility of the early internet. A related NIPC Advisory from December 1, 2000, titled "E-Commerce Vulnerabilities," shows the center expanding its gaze toward the commercial sector, recognizing that the economy's shift toward digital transactions created new points of failure.

Simultaneously, the military was attempting to integrate these digital threats into a broader strategic framework. An April 2000 paper from Air University, "Space War Meets Info War: The Integration of Space and Information Operations," suggests that by the time Vatis was testifying to the Senate, the Department of Defense was already viewing "information operations" as a sibling to space warfare.

The NIPC's efforts to combat intrusions were mirrored by other studies, such as the October 13, 2000, Department of Defense Reserve Component Employment Study, which looked into a "Joint Reserve Component Virtual Information Operations Organization." The records describe a fragmented effort: the FBI handling the investigations, the NIPC managing the protection of critical systems, and the DoD exploring how to weaponize and defend information in a virtual environment.

Post-NIPC Records

The National Infrastructure Protection Center did not survive the shifts in government structure that followed the events of 2001. The archive notes that the unit was subsequently transferred to the Department of Homeland Security, an entity created to centralize the very interagency cooperation Vatis described in his March 1 testimony. Eventually, the NIPC was disestablished entirely.

What remains is the paper trail of its existence. The catalogue entry for Vatis's statement marks a moment when the federal government first attempted to summarize the "source of cyber threats" for the legislative branch. It captures a transition point where the government moved from treating computer intrusions as isolated security breaches to treating them as a systemic vulnerability.

The archival description leaves the specific nature of the "incidents and investigations" Vatis reviewed to the missing pages of the original record. It remains unclear which specific intrusions of the late 1990s prompted the warnings delivered to the Senate in the spring of 2000.