Nvidia's Security Chief Left in August. Then Its CEO Did Too.

When Nvidia's longtime chief security officer and head of product security stepped down in August, few outside the company noticed. Two and a half months later, chief executive Jensen Huang himself left the company amid growing questions about his extramarital relationships — starting with an executive at Megaspeed, a Singapore data centre company that US investigators suspect of funneling Nvidia chips to China, and widening to reports of two separate affairs with Nvidia employees, according to TechCrunch.

The timing has raised an uncomfortable question: what did Nvidia's security team know, and could it have done anything about it?

A quiet departure in August

David Reber spent four years as Nvidia's chief security officer and seven years at the company overall. When he left in late August, he said he was stepping away for health reasons, writing on LinkedIn that he had been diagnosed with young-onset Parkinson's more than two years earlier.

His replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager, before a year at Salesforce and several years at the cybersecurity company ReversingLabs. According to TechCrunch, Zdjelar did not respond to questions about the transition or what the security team knew. Reber also did not respond to questions, and Nvidia has not answered related questions from the outlet.

Nothing public connects the changes in the security leadership to the Megaspeed matter. But TechCrunch notes that parts of the picture were known inside Nvidia: the company's top lawyer was engaged with the government's Megaspeed inquiry more than a year ago, according to reporting by The New York Times, and reports about Huang's relationships with employees suggest colleagues were aware of them, even if the behaviour is not expressly forbidden by Nvidia's code of conduct.

The wrong job for the problem

Relationships between a chief executive and employees typically fall to human resources, legal and the board — not to security. But specialists told TechCrunch that any affair can hand a foreign intelligence service leverage over an executive who wants it kept quiet, and Huang's relationship with an executive at a company under federal investigation was not an office matter at all. Megaspeed has denied any wrongdoing.

Spotting such risks is genuinely hard, according to retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals. Intelligence services gather much of their information through everyday conversation rather than hacking, which makes the clues difficult for security teams to identify.

Even when a team does see the risk, its resources are often limited. Security teams are frequently underfunded because, unlike other parts of a business, they do not generate revenue, Eftimiades said — and he described it as astonishingly common for chief executives to answer a security team's warnings by saying they would spend not a nickel more than compliance requires.

Many companies also define security too narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, chief executive of the corporate investigations firm Interfor International, and author Jeremy Hurewitz argued that too many companies still treat security mainly as protecting facilities, preventing cyberattacks and responding to physical threats — and that teams need to pay far greater attention to insider threats, including the cultivation of executives by foreign intelligence services.

What a rival service actually wants

The target is often less the technology itself than policy insight: who is pushing to change export rules, and who is blocking them. Eftimiades offered a hypothetical in which a chief executive complains that he cannot do something because he is fighting a board that does not want to do it — information that tells an intelligence asset exactly who the obstacle is.

The playbook is not new, Eftimiades added, particularly where China is concerned. What is newer, he said, is that the relationships these services cultivate now often last years rather than weeks. Technology can augment that human intelligence: he pointed to IMSI catchers, devices that mimic a cell tower so nearby phones connect to them, with a basic version costing about $1,000 and fitting in a suitcase.

Eftimiades said no one knows yet whether such devices were used against Huang, whose phone was presumably hardened so compromises could be detected if not stopped. What Nvidia's security team knew — and whether it could have acted — will only become clearer as the board's independent investigation and federal inquiries proceed. In the meantime, he hopes the episode is a wake-up call for US industry, which he described as mostly clueless about China's tactics.

Written by the BidAsk Newsroom. Based on reporting from the sources below.