Outsiders had little reason to notice when Nvidia’s longtime chief security officer and head of product security stepped down in August. Just two and a half months later, CEO Jensen Huang himself left the company over growing questions about his extramarital relationships — starting with an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China, then widening to reports about two separate affairs with Nvidia employees.
At the time, David Reber, who spent four years as CSO and seven at Nvidia overall, said he was leaving for health reasons. “This wasn’t a pivot I had planned. But I know what needs to come first: family and health,” he wrote on LinkedIn in late August, disclosing that he’d been diagnosed with young-onset Parkinson’s more than two years ago.
Reber’s replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager before spending one year at Salesforce and several years at the cybersecurity company ReversingLabs. Zdjelar didn’t respond to questions Thursday about the transition or what the security team knew.
Nothing public connects Reber’s or Zdjelar’s role changes
Nothing public connects Reber’s or Zdjelar’s role changes to the Megaspeed matter, but it seems fair to wonder what Nvidia’s security team knew about the government’s scrutiny of Megaspeed and about Huang’s relationships, and whether anyone raised concerns. Reber didn’t respond to questions Thursday. Nvidia also has not answered our related questions.
Not all of those relationships are the business of the security team. Relationships with subordinates typically fall to HR, legal, and the board. But an affair with an executive at a company under federal investigation is a different animal. (Megaspeed has denied any wrongdoing.) Security specialists say affairs can create vulnerabilities that foreign intelligence services look to exploit.
Catching that kind of exposure isn’t easy. The way intelligence services collect information, much of it through everyday conversation rather than hacking, makes it especially difficult for security teams to identify risks, according to retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals.
Some people inside Nvidia clearly knew parts
Some people inside Nvidia clearly knew parts of the picture. Nvidia’s top lawyer was engaged with the government’s Megaspeed inquiry more than a year ago, The New York Times reported earlier this week. (Nvidia has said it regularly contacts officials.) Reports about Huang’s relationships with employees suggest colleagues also knew of them, even if the behavior is not expressly forbidden by Nvidia’s code of conduct. The Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship. What’s unclear is whether any of that reached security.
Even if it had reached Nvidia’s security team, Eftimiades, who wrote Chinese Espionage Operations and Tactics in 2020, said a security team’s red because, unlike some other cost centers, they don’t drive revenue. It’s astonishingly common for CEOs to answer a security team’s warnings with “not a nickel more than compliance,” he said
Many companies also define security very narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz, wrote, “Too many companies still approach security primarily as a matter of protecting facilities, preventing cyberattacks, and responding to physical threats.” The two argued that “[s]ecurity teams need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest and attempts to obtain sensitive information through trusted personal contacts.”
Some of it is beyond what any team
Still, some of it is beyond what any team can do. Speaking generally, not about Huang, Eftimiades offered a hypothetical in which a CEO complains that he can’t do something because “I’m fighting a board who doesn’t want to do this.” That tells an intelligence asset who the obstacle is. The service then asks, “Who’s the sticking point here?” and looks for ways into that person’s email and phone.
What a rival intelligence service wants is often less technology than policy insight, including who’s pushing to change export rules and who the biggest blocker is. “Intel world tends to be like cancer,” he said. “Once it gets into the body, it looks to spread and looks to reach out.”
The playbook isn’t new, Eftimiades added, “particularly for China.” Any executive dealing with the country “will tell you that they’ve been approached.” He said there are also “tons of diplomat stories” of U.S. diplomats walking into a hotel room to find a woman on the bed. He said what’s newer compared with Soviet era spying is the relationships these services cultivate now often last years, not weeks.
Technology can augment that human intelligence, Eftimiades said,
Technology can augment that human intelligence, Eftimiades said, pointing to IMSI catchers are one example. These devices mimic a cell tower so that nearby phones connect to them. A basic version can cost about $1,000 and fit in a suitcase, he said, though government-grade models cost far more.
Eftimiades says no one knows yet if these were used against Huang, whose phone was presumably hardened such that compromises could be detected, if not stopped altogether. But either way, what Nvidia’s security team knew, and whether it could have acted on it, should become clearer as the board’s independent investigation and federal inquiries proceed.
In the meantime, Eftimiades said he hopes the whole episode is “a wake-up call” for U.S. industry, which he said is mostly “clueless” about China’s tactics. “We have lost trillions [of dollars] in intellectual property,” is his guess. “Whatever we think we’re doing isn’t working.”
