Where was Nvidia’s security team?

Outsiders had little reason to notice when Nvidia’s longtime chief security officer and head of product security stepped down in August. Just two and a half months later, CEO Jensen Huang himself left the company over growing questions about his extramarital relationships — starting with an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China, then widening to reports about two separate affairs with Nvidia employees.

At the time, David Reber, who spent four years as CSO and seven at Nvidia overall, said he was leaving for health reasons. “This wasn’t a pivot I had planned. But I know what needs to come first: family and health,” he wrote on LinkedIn in late August, disclosing that he’d been diagnosed with young-onset Parkinson’s more than two years ago.

Reber’s replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager before spending one year at Salesforce and several years at the cybersecurity company ReversingLabs. Zdjelar didn’t respond to questions Thursday about the transition or what the security team knew.

Nothing public connects Reber’s or Zdjelar’s role changes to the Megaspeed matter, but it seems fair to wonder what Nvidia’s security team knew about the government’s scrutiny of Megaspeed and about Huang’s relationships, and whether anyone raised concerns. Reber didn’t respond to questions Thursday. Nvidia also has not answered our related questions.

Relationships between a CEO and his employees typically fall to HR, legal and the board, not security. But security specialists say any affair — even one inside the office — can give a foreign intelligence service leverage over an exec who wants it kept quiet. And Huang’s relationship with an executive at Megaspeed, a company under federal investigation, wasn’t an office matter at all. (Megaspeed has denied any wrongdoing.)

Still, spotting the clues isn’t easy. The way intelligence services collect information, much of it through everyday conversation rather than hacking, makes it especially difficult for security teams to identify risks, according to retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals.

Some people inside Nvidia clearly knew parts of the picture. Nvidia’s top lawyer was engaged with the government’s Megaspeed inquiry more than a year ago, The New York Times reported earlier this week. (Nvidia has said it regularly contacts officials.) Reports about Huang’s relationships with employees suggest colleagues also knew of them, even if the behavior is not expressly forbidden by Nvidia’s code of conduct. The Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship. What’s unclear is whether any of that reached security.

Even if it had reached Nvidia’s security team, Eftimiades, who wrote Chinese Espionage Operations and Tactics in 2020, said a security team’s resources are often limited. For one thing, they’re often underfunded because, unlike some other cost centers, they don’t drive revenue. It’s astonishingly common for CEOs to answer a security team’s warnings with “not a nickel more than compliance,” he said.

Many companies also define security overly narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz, wrote, “Too many companies still approach security primarily as a matter of protecting facilities, preventing cyberattacks, and responding to physical threats.” The two argued that “[s]ecurity teams need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest and attempts to obtain sensitive information through trusted personal contacts.”

It would be surprising if Nvidia’s security team didn’t have a more expansive remit than most companies given its scale and business partners, but it’s possible.

In fairness, some of it is simply beyond what any team can do. Speaking generally, not about Huang, Eftimiades offered a hypothetical in which a CEO complains that he can’t do something because “I’m fighting a board who doesn’t want to do this.” That tells an intelligence asset who the obstacle is. The service then asks, “Who’s the sticking point here?” and looks for ways into that person’s email and phone.

What a rival intelligence service wants is often less technology than policy insight, including who’s pushing to change export rules and who the biggest blocker is. “Intel world tends to be like cancer,” he said. “Once it gets into the body, it looks to spread and looks to reach out.”

The playbook isn’t new, Eftimiades added, “particularly for China.” Any executive dealing with the country “will tell you that they’ve been approached.” He said there are also “tons of diplomat stories” of U.S. diplomats walking into a hotel room to find a woman on the bed. He said what’s newer compared with Soviet era spying is the relationships these services cultivate now often last years, not weeks.

Technology can augment that human intelligence, Eftimiades said, pointing to IMSI catchers as one example. The devices mimic a cell tower so that nearby phones connect to them. A basic version can cost about $1,000 and fit in a suitcase, he said, though government-grade models cost far more, and there were a couple of cases involving Chinese espionage where these factored in last year.

Eftimiades says no one knows yet if the devices were used against Huang, whose phone was presumably hardened such that compromises could be detected, if not stopped altogether. But what Nvidia’s security team knew, and whether it could have acted on it, will only become clearer as the board’s independent investigation and federal inquiries proceed.

In the meantime, Eftimiades said he hopes the whole episode is “a wake-up call” for U.S. industry, which he said is mostly “clueless” about China’s tactics. “We have lost trillions [of dollars] in intellectual property,” is his guess. “Whatever we think we’re doing isn’t working.”