Questions surround Nvidia security team after CEO departure

Nvidia's longtime chief security officer stepped down in August, and CEO Jensen Huang later left the company amid growing questions about his extramarital relationships, including one involving an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China. The circumstances have raised questions about what Nvidia's security team knew and whether it raised concerns.

Leadership changes and unanswered questions

David Reber, who spent four years as chief security officer and seven years at Nvidia overall, said he was leaving for health reasons and disclosed a young-onset Parkinson's diagnosis made more than two years earlier. His replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil, one year at Salesforce and several years at ReversingLabs. Nothing public connects either role change to the Megaspeed matter, and neither Reber nor Nvidia answered related questions Thursday. Nvidia's top lawyer was engaged with the government's Megaspeed inquiry more than a year ago, The New York Times reported, and reports about Huang's relationships suggest colleagues also knew of them, even though the behavior is not expressly forbidden by Nvidia's code of conduct. The Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship.

Security risks and limits

Relationships between a CEO and employees typically fall to HR, legal and the board rather than security, but security specialists say any affair can give a foreign intelligence service leverage over an executive who wants it kept quiet. Huang's relationship with a Megaspeed executive was not an office matter, and Megaspeed has denied wrongdoing. Spotting clues is difficult because intelligence services often collect information through everyday conversation rather than hacking, according to retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals. Even if concerns reached Nvidia's security team, its resources may have been limited, since security teams are often underfunded because they do not drive revenue, and CEOs may resist spending beyond compliance. Specialists also say many companies define security too narrowly; Don Aviv and Jeremy Hurewitz argued in The Hill that security teams should pay greater attention to insider threats, suspicious business relationships, conflicts of interest and attempts to obtain sensitive information through trusted personal contacts.

Investigations may clarify what happened

Eftimiades said a rival intelligence service may seek policy insight, such as who is pushing to change export rules and who is the biggest blocker, and that relationships cultivated now often last years rather than weeks. Technology can augment human intelligence, he said, pointing to IMSI catchers that mimic a cell tower so nearby phones connect to them; a basic version can cost about $1,000 and fit in a suitcase, while government-grade models cost far more. He said no one knows yet if such devices were used against Huang, whose phone was presumably hardened so compromises could be detected if not stopped. What Nvidia's security team knew, and whether it could have acted, may become clearer as the board's independent investigation and federal inquiries proceed. Eftimiades said he hopes the episode is a wake-up call for U.S. industry, which he called mostly clueless about China's tactics, and estimated that China has taken trillions of dollars in intellectual property.

Sources: TechCrunch