Nvidia’s chief security officer David Reber left the company in August, just months before CEO Jensen Huang resigned amid allegations of extramarital affairs and a government probe into Megaspeed, a Singapore data centre suspected of funneling Nvidia chips to China.
Reber, who spent seven years at Nvidia including four as CSO, cited health reasons for his departure. He told LinkedIn he had been diagnosed with young-onset Parkinson’s more than two years ago and that family and health came first. He did not mention a planned pivot.
Saša Zdjelar now heads product security. She spent 17 years at ExxonMobil in Houston, worked one year at Salesforce, and spent several years at the cybersecurity firm ReversingLabs before joining Nvidia. She did not comment Thursday on the transition or what the security team knew.
No public documents link Reber’s or Zdjelar’s moves to the Megaspeed investigation or Huang’s relationships. It is reasonable to question whether the security team was aware of government scrutiny of Megaspeed or Huang’s conduct, and if anyone raised concerns. Neither Reber nor Nvidia has answered questions on these points.
Relationships with subordinates usually fall to human resources, legal, and the board. An affair with an executive at a company under federal investigation is different. Security specialists say such conduct can create vulnerabilities that foreign intelligence services seek to exploit.
Detecting that exposure is difficult. Intelligence services often gather information through everyday conversation rather than hacking, making it hard for security teams to spot risks, according to retired senior intelligence officer Nicholas Eftimiades. He has trained more than 1,000 corporate security professionals.
Some people inside Nvidia clearly knew parts of the picture. Nvidia’s top lawyer engaged with the government’s Megaspeed inquiry more than a year ago, The New York Times reported earlier this week. Nvidia stated it regularly contacts officials.
Reports on Huang’s relationships suggest colleagues knew of them, even if the behaviour is not expressly forbidden by Nvidia’s code of conduct. The Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him. Reuters, citing two people, later reported a second relationship. It is unclear whether any of that reached security.
Even if it had reached the security team, Eftimiades said resources are often limited. He noted that security teams are frequently underfunded because, unlike some other cost centres, they do not drive revenue. He said it is common for CEOs to answer security warnings with “not a nickel more than compliance.”
Many companies also define security narrowly. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz wrote that too many companies approach security primarily as protecting facilities, preventing cyberattacks, and responding to physical threats.
They argued security teams need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest, and attempts to obtain sensitive information through trusted personal contacts.
Some issues are beyond what any team can do. Eftimiades offered a hypothetical where a CEO complains he cannot act because he is fighting a board that refuses. That tells an intelligence asset who the obstacle is. The service then asks who the sticking point is and looks for ways into that person’s email and phone.
What a rival intelligence service wants is often less technology than policy insight, including who is pushing to change export rules and who the biggest blocker is. “Intel world tends to be like cancer,” he said. “Once it gets into the body, it looks to spread and looks to reach out.”
The playbook is not new, Eftimiades added, particularly for China. Any executive dealing with the country will tell you they have been approached. He said there are also “tons of diplomat stories” of US diplomats walking into a hotel room to find a woman on the bed.
What is newer compared with Soviet era spying is that the relationships these services cultivate now often last years, not weeks.
Technology can augment human intelligence. Eftimiades pointed to IMSI catchers as one example. These devices mimic a cell tower so that nearby phones connect to them. A basic version can cost about $1,000 and fit in a suitcase, he said, though government-grade models cost far more.
Eftimiades said no one knows yet if these were used against Huang, whose phone was presumably hardened such that compromises could be detected, if not stopped altogether. Either way, what Nvidia’s security team knew, and whether it could have acted on it, should become clearer as the board’s independent investigation and federal inquiries proceed.
In the meantime, Eftimiades said he hopes the whole episode is “a wake-up call” for US industry, which he said is mostly “clueless” about China’s tactics. He guessed the sector has lost trillions of dollars in intellectual property. “Whatever we think we’re doing isn’t working,” he said.
