What Did Nvidia's Security Team Know About the Huang Scandal?

Nvidia (NVDA) is facing questions about what its security team knew of former CEO Jensen Huang's extramarital relationships and the federal inquiry into Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China. The questions come as the company's chief security officer changed hands in August, two and a half months before Huang left.

David Reber, who spent four years as chief security officer and seven years at Nvidia overall, stepped down in late August. At the time, Reber said he was leaving for health reasons, disclosing on LinkedIn that he had been diagnosed with young-onset Parkinson's more than two years earlier. His replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil in Houston before one year at Salesforce and several years at the cybersecurity company ReversingLabs. Neither Reber nor Zdjelar responded to questions Thursday about the transition or what the security team knew, and Nvidia has not answered related questions.

Nothing public connects Reber's or Zdjelar's role changes to the Megaspeed matter. But the question of what Nvidia's security team knew about the government's scrutiny of Megaspeed and about Huang's relationships, and whether anyone raised concerns, remains open.

Relationships between a CEO and employees typically fall to HR, legal and the board rather than security. But security specialists say any affair, even one inside the office, can give a foreign intelligence service leverage over an executive who wants it kept quiet. Huang's relationship with an executive at Megaspeed, a company under federal investigation, was not an office matter at all. Megaspeed has denied any wrongdoing.

Spotting such risks is difficult, according to retired senior intelligence officer Nicholas Eftimiades, who said he has trained more than 1,000 corporate security professionals. Intelligence services collect much of their information through everyday conversation rather than hacking, making it especially hard for security teams to identify risks.

Some people inside Nvidia clearly knew parts of the picture. Nvidia's top lawyer was engaged with the government's Megaspeed inquiry more than a year ago, according to a New York Times report earlier this week. Reports about Huang's relationships with employees suggest colleagues also knew of them, even if the behavior is not expressly forbidden by Nvidia's code of conduct. The Times cited five Nvidia employees who said Huang was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship. What is unclear is whether any of that reached security.

Even if it had, Eftimiades said a security team's resources are often limited, and teams are frequently underfunded because they do not drive revenue. He said it is astonishingly common for CEOs to answer a security team's warnings with not a nickel more than compliance. Many companies also define security too narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz argued that security teams need to pay greater attention to insider threats, including the cultivation of executives by foreign intelligence services, suspicious business relationships, conflicts of interest and attempts to obtain sensitive information through trusted personal contacts.

What a rival intelligence service wants is often less technology than policy insight, including who is pushing to change export rules and who the biggest blocker is. Eftimiades also pointed to IMSI catchers, devices that mimic a cell tower so that nearby phones connect to them. A basic version can cost about $1,000 and fit in a suitcase, he said, though government-grade models cost far more. He said no one knows yet if these were used against Huang, whose phone was presumably hardened such that compromises could be detected, if not stopped altogether.

What Nvidia's security team knew, and whether it could have acted on it, should become clearer as the board's independent investigation and federal inquiries proceed. Eftimiades said he hopes the whole episode is a wake-up call for U.S. industry, which he said is mostly clueless about China's tactics. We have lost trillions of dollars in intellectual property, he estimated. Whatever we think we are doing is not working.

Nvidia shares were down about 2.0 percent in delayed trading at $162.85.