What Nvidia’s security team knew about its executives’ ties

Nvidia’s security leadership changed: David Reber left in August after four years as chief security officer and seven years at the company. Two and a half months later, CEO Jensen Huang left the company amid questions about his extramarital relationships, including one with the head of Singapore-based Megaspeed. US investigators suspect Megaspeed of smuggling Nvidia chips into China. No public information links the personnel changes to the investigation or Huang’s relationships. But it remains unclear what Nvidia’s security team knew and whether anyone raised concerns.

What Nvidia’s security team knew about its executives’ ties

Leadership changes

At the end of August, Reber announced on LinkedIn that he was leaving for health reasons. More than two years earlier, he had been diagnosed with early-onset Parkinson’s disease. He wrote that he had not planned such a change, but that family and health had to come first.

Reber’s successor was Sasha Zdzielar. Before joining Nvidia, he spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager. He then spent a year at Salesforce, followed by several years at cybersecurity company ReversingLabs. On Thursday, Zdzielar did not answer questions about the transition or what the security team might have known. Reber also did not respond to questions, and Nvidia did not provide answers to requests on the subject.

Nothing publicly links the leadership changes to the Megaspeed case. Still, questions remain about whether the security team knew that authorities were scrutinizing Megaspeed and about Huang’s relationships, and whether anyone raised those issues.

What risks the company might have seen

Not all personal relationships fall within the remit of a security team. Executives’ relationships with subordinates generally fall under the responsibility of human resources, lawyers and the board. But a relationship with the head of a company under federal investigation is a different matter. Megaspeed denies wrongdoing.

Security specialists warn that relationships can create vulnerabilities that foreign intelligence services may try to exploit. Identifying such risks is difficult: intelligence services gather information not only through hacking but also through everyday conversations, said Nicholas Eftimiades, a former senior intelligence officer. Eftimiades says he has trained more than 1,000 corporate security professionals.

Some Nvidia employees appear to have known certain details, based on published reports. Earlier this week, The New York Times reported that Nvidia’s chief legal officer had been involved in contacts with authorities over the Megaspeed investigation more than a year ago. Nvidia has said it regularly communicates with government officials.

Reports about Huang’s relationships with female employees also suggest that colleagues may have known about them, although Nvidia’s code of conduct does not explicitly prohibit such relationships. The New York Times cited five Nvidia employees who described Huang’s relationship with a vice president who reported directly to him. Later, Reuters reported a second relationship, citing two people familiar with the matter. It is unknown whether this information reached the security team.

Limited resources and the security team’s remit

Even if Nvidia’s security team received this information, its ability to act may have been limited. Eftimiades, author of the 2020 book Chinese Espionage Operations and Tactics, says corporate security teams often lack funding: unlike some other departments, they do not generate revenue. Company leaders often respond to risk warnings by saying they are willing to allocate only the funds needed to meet requirements, he says.

Specialists also note that many companies take too narrow a view of security. In an article for The Hill, Don Aviv, CEO of corporate investigations firm Interfor International, and author Jeremy Hurewitz wrote that companies remain focused mainly on protecting facilities, preventing cyberattacks and responding to physical threats. In their view, security teams should pay more attention to insider threats: foreign intelligence services’ attempts to recruit executives and employees, suspicious business ties, conflicts of interest and efforts to obtain sensitive information through trusted personal contacts.

Some threats may be beyond the reach of even a security team. Eftimiades gave a hypothetical example: a CEO complains that he cannot take certain action because the board opposes it. That tells an intelligence source exactly who is standing in the way. The intelligence service can then identify the obstacle and seek access to that person’s email and phone.

A rival intelligence service may be interested less in technology than in politics: who is pushing to change export rules and who is most strongly opposing the change. Eftimiades compared intelligence work to cancer: once it enters the body, it spreads.

Intelligence methods and the role of technology

These methods are not new, especially in the case of China, Eftimiades said. Executives who work with the country say they have been approached. He also mentioned numerous stories from diplomats about US representatives finding women waiting on their hotel-room beds. What is new compared with the Soviet era, he said, is the length of the relationships intelligence services build with people: they can now last for years rather than weeks.

Technology can supplement human intelligence work. One example is a device that mimics a cell tower and connects nearby phones to it. A basic version of such a device costs about $1,000 and fits in a suitcase, Eftimiades said; models made for government agencies cost much more.

Eftimiades does not know whether such devices were used against Huang. He assumed Huang’s phone was protected so that attempts to interfere with it could be detected, if not prevented entirely. What Nvidia’s security team knew and whether it could act should become clearer as the board’s independent investigation and federal investigations proceed.

Eftimiades hopes the story will serve as a warning to US industry, which in his assessment has a poor understanding of China’s methods. He believes the country has lost trillions of dollars’ worth of intellectual property and says current measures are not working.

Dataist's take: This story shows the limits of corporate security: even when employees spot a risk, the security team may lack the resources or authority to address it. Investigations will have to establish what happened at Nvidia; for now, there are no public answers about the security team’s actions.