Nvidia's Security Team Faces Questions as CEO Scandal Widens

Nvidia's chief security officer stepped down in August, and CEO Jensen Huang left the company just two and a half months later amid growing questions about his extramarital relationships. The timing has put the chipmaker's internal security function under a spotlight it never asked for.

David Reber, who spent four years as CSO and seven at Nvidia overall, said at the time he was leaving for health reasons. "This wasn't a pivot I had planned. But I know what needs to come first: family and health," he wrote on LinkedIn in late August, disclosing a diagnosis of young-onset Parkinson's more than two years ago. He didn't respond to questions Thursday.

His replacement, Saša Zdjelar, spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager, then worked one year at Salesforce and several years at the cybersecurity company ReversingLabs. Zdjelar also didn't respond to questions Thursday about the transition or what the security team knew. Nvidia hasn't answered related questions either.

What connects the departures to the Megaspeed probe?

Nothing public connects either role change to the Megaspeed matter. But the questions keep coming. One of Huang's reported relationships involved an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China. Later reports described two separate affairs with Nvidia employees.

Not every relationship falls under security's remit. Affairs with subordinates typically go to HR, legal, and the board. An affair with an executive at a company under federal investigation is, as the reporting notes, a different animal. Megaspeed has denied any wrongdoing.

Some people inside Nvidia clearly knew pieces of the picture. The New York Times reported this week that Nvidia's top lawyer was engaged with the government's Megaspeed inquiry more than a year ago. Nvidia has said it regularly contacts officials.

The Times cited five Nvidia employees who said Huang was involved with a vice president reporting directly to him. Reuters, citing two people, later reported a second relationship. Nvidia's code of conduct doesn't expressly forbid the behavior. What's unclear is whether any of it reached the security team.

Why are corporate security teams often blind to this risk?

Catching that kind of exposure is hard. Retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals, notes that intelligence services collect much of their information through everyday conversation rather than hacking. That makes the risks especially difficult for security teams to identify.

Resources are part of the problem. Security teams don't drive revenue, so they're often underfunded, said Eftimiades, author of the 2020 book Chinese Espionage Operations and Tactics. CEOs routinely answer security warnings with "not a nickel more than compliance," he said.

Narrow definitions of security compound the issue. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz wrote, "Too many companies still approach security primarily as a matter of protecting facilities, preventing cyberattacks, and responding to physical threats." They argued that "[s]ecurity teams need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest and attempts to obtain sensitive information through trusted personal contacts."

How do foreign intelligence services actually operate?

Some exposure is beyond any team's control. Speaking generally, not about Huang, Eftimiades offered a hypothetical: a CEO complains he can't act because "I'm fighting a board who doesn't want to do this." That tells an intelligence asset who the obstacle is. The service then asks, "Who's the sticking point here?" and looks for ways into that person's email and phone.

Rival services often want policy insight more than technology, including who's pushing to change export rules and who the biggest blocker is. "Intel world tends to be like cancer," Eftimiades said. "Once it gets into the body, it looks to spread and looks to reach out."

The playbook isn't new, "particularly for China," he added. Any executive dealing with the country "will tell you that they've been approached." He also cited "tons of diplomat stories" of U.S. diplomats finding a woman on the bed in their hotel room. What's newer than Soviet-era spying is that cultivated relationships now often last years, not weeks.

Technology can augment the human side. Eftimiades pointed to IMSI catchers, devices that mimic a cell tower so nearby phones connect to them. A basic version costs about $1,000 and fits in a suitcase, he said, while government-grade models cost far more.

Nobody knows yet whether such tools were used against Huang, whose phone was presumably hardened enough that compromises could be detected, if not stopped. What Nvidia's security team knew, and whether it could have acted, should become clearer as the board's independent investigation and federal inquiries proceed.

Until then, Eftimiades hopes the episode is "a wake-up call" for U.S. industry, which he called mostly "clueless" about China's tactics. "We have lost trillions [of dollars] in intellectual property," he said. "Whatever we think we're doing isn't working."