Nvidia Has Not Said What Its Security Team Knew Before Jensen Huang's Exit
Nvidia has not answered questions about what its security team knew before chief executive Jensen Huang left the company, TechCrunch reported on November 15. The company's longtime chief security officer stepped down in August, about two and a half months before Huang's departure, and nothing public connects the two changes — but security specialists say the questions are worth asking.
Nvidia Has Not Said What Its Security Team Knew Before Jensen Huang's Exit
Nvidia has not said what its security team knew about the federal scrutiny of Megaspeed or about former chief executive Jensen Huang's personal relationships before he left the company, according to a TechCrunch report published on November 15. The questions land at an uncomfortable moment for the chipmaker, whose leadership has been upended in a matter of weeks.
Huang left Nvidia over growing questions about his extramarital relationships. The first involved an executive at Megaspeed, a Singapore data centre company that United States investigators suspect of funnelling Nvidia chips to China in breach of export controls. Reports of two separate affairs with Nvidia employees followed. Megaspeed has denied any wrongdoing.
A security chief's quiet departure in August
Two and a half months before Huang's exit, Nvidia's longtime chief security officer and head of product security, David Reber, stepped down. Reber had spent four years as chief security officer and seven years at Nvidia in total.
At the time, Reber said he was leaving for health reasons. In a LinkedIn post in late August, he disclosed that he had been diagnosed with young-onset Parkinson's more than two years earlier. "This wasn't a pivot I had planned. But I know what needs to come first: family and health," he wrote.
His replacement, Sasa Zdjelar, came from outside the chip industry's usual orbit. He spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager, then spent one year at Salesforce and several years at the cybersecurity company ReversingLabs before joining Nvidia.
Nothing public connects either Reber's departure or Zdjelar's appointment to the Megaspeed matter. But TechCrunch reports that neither man responded to questions on Thursday about the transition or about what the security team knew, and Nvidia has not answered related questions either.
What was known inside Nvidia — and what was not
The gap in the public record is what makes the question difficult to dismiss. Some people inside Nvidia clearly knew parts of the picture. The New York Times reported earlier this week that Nvidia's top lawyer had been engaged with the government's Megaspeed inquiry more than a year ago. Nvidia has said it regularly contacts officials.
Reports about Huang's relationships with employees also suggest colleagues knew of them, even though the behaviour is not expressly forbidden by Nvidia's code of conduct. The Times cited five Nvidia employees who said Huang was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship.
What remains unclear is whether any of that information ever reached the security team. Relationships between a chief executive and his employees would normally fall to human resources, legal and the board rather than to security. But security specialists say that is only part of the story.
Why specialists say the question matters
An affair, even one inside the office, can give a foreign intelligence service leverage over an executive who wants it kept quiet, specialists told TechCrunch. And Huang's relationship with an executive at Megaspeed, a company under federal investigation, was not an office matter at all.
Retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals and wrote Chinese Espionage Operations and Tactics in 2020, said such risks can be hard to spot. Much of the information intelligence services collect comes through everyday conversation rather than hacking, he said, which makes it especially difficult for security teams to identify a threat.
Security teams also often work with limited resources, Eftimiades said. They are frequently underfunded because, unlike some other parts of a company, they do not drive revenue. He said it is "astonishingly common" for chief executives to answer a security team's warnings with "not a nickel more than compliance."
Many companies also define security too narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, chief executive of the corporate investigations firm Interfor International, and author Jeremy Hurewitz argued that too many companies still treat security mainly as protecting facilities, preventing cyberattacks and responding to physical threats. Security teams, they wrote, need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest and attempts to obtain sensitive information through trusted personal contacts.
Policy insight, not just technology
What a rival intelligence service wants is often less technology than policy insight, Eftimiades said — who is pushing to change export rules, and who the biggest blocker is. He described the intelligence world as being "like cancer" in the way it spreads once it gets inside an organisation.
Technology can add to that human intelligence, he said, pointing to IMSI catchers as one example. The devices mimic a cell tower so that nearby phones connect to them. A basic version can cost about 1,000 dollars and fit in a suitcase, he said, though government-grade models cost far more, and there were a couple of cases involving Chinese espionage where they factored in last year.
Eftimiades said no one knows yet whether such devices were used against Huang, whose phone was presumably hardened so that compromises could be detected, if not stopped altogether. But what Nvidia's security team knew, and whether it could have acted on it, will only become clearer as the board's independent investigation and the federal inquiries proceed.
In the meantime, Eftimiades said he hopes the episode is "a wake-up call" for United States industry, which he said is mostly "clueless" about China's tactics. He guessed that trillions of dollars in intellectual property have been lost. "Whatever we think we're doing isn't working," he said.
The episode has already reshaped Nvidia's leadership. For background on how the board learned about the affair, see Jensen Huang misled Nvidia leaders about Alice Huang affair. On the banned chips found at a Shanghai facility, see Banned Nvidia AI chips found at Shanghai data centre. And on the person now running the company, see Colette Kress, Nvidia's interim chief executive.
Sources
What's Your Reaction?
Like
0
Dislike
0
Love
0
Funny
0
Angry
0
Sad
0
Wow
0