Nvidia's Security Team Faces Questions as CSO Exit and CEO Scandal Collide

Nvidia's chief security officer stepped down in August. Two and a half months later, CEO Jensen Huang left the company. The timing has put Nvidia's security organization under scrutiny it never invited.

David Reber spent four years as CSO and seven at Nvidia overall. He said he was leaving for health reasons. "This wasn't a pivot I had planned. But I know what needs to come first: family and health," he wrote on LinkedIn in late August. He disclosed a diagnosis of young-onset Parkinson's more than two years ago.

His replacement, Saša Zdjelar, spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager. He then worked one year at Salesforce and several years at cybersecurity firm ReversingLabs. Zdjelar did not respond to questions Thursday about the transition or what the security team knew.

What happened at the top?

Huang's departure followed growing questions about extramarital relationships. The first involved an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China. Reports then widened to two separate affairs with Nvidia employees.

Nothing public connects the role changes of Reber or Zdjelar to the Megaspeed matter. But the questions remain. Reber did not respond to questions Thursday. Nvidia has not answered related questions either.

Not every relationship falls to security. Affairs with subordinates typically belong to HR, legal, and the board. An affair with an executive at a company under federal investigation is different. Megaspeed has denied any wrongdoing. Security specialists say affairs can create vulnerabilities that foreign intelligence services exploit.

What did people inside Nvidia know?

Some clearly knew parts of the picture. Nvidia's top lawyer engaged with the government's Megaspeed inquiry more than a year ago, The New York Times reported this week. Nvidia has said it regularly contacts officials.

The Times cited five Nvidia employees who said Huang was involved with a vice president reporting directly to him. Reuters, citing two people, later reported a second relationship. Nvidia's code of conduct does not expressly forbid such behavior. What remains unclear is whether any of it reached the security team.

Why is this hard to catch?

Intelligence services collect much of their information through everyday conversation rather than hacking. That makes the risk especially difficult for security teams to identify, according to retired senior intelligence officer Nicholas Eftimiades. He says he has trained more than 1,000 corporate security professionals.

Eftimiades, author of "Chinese Espionage Operations and Tactics" (2020), said security teams are often underfunded because they do not drive revenue. It is astonishingly common for CEOs to answer security warnings with "not a nickel more than compliance," he said.

Many companies also define security too narrowly. Don Aviv, CEO of corporate investigations firm Interfor International, and author Jeremy Hurewitz wrote in The Hill: "Too many companies still approach security primarily as a matter of protecting facilities, preventing cyberattacks, and responding to physical threats." They argued security teams must pay greater attention to insider threats, including the cultivation of executives by foreign intelligence services, suspicious business relationships, conflicts of interest, and attempts to obtain sensitive information through trusted personal contacts.

How does the espionage playbook work?

Speaking generally and not about Huang, Eftimiades offered a hypothetical. A CEO complains he cannot act because "I'm fighting a board who doesn't want to do this." That tells an intelligence asset who the obstacle is. The service then asks, "Who's the sticking point here?" and looks for ways into that person's email and phone.

Rival services often want policy insight more than technology. That includes who pushes to change export rules and who blocks them. "Intel world tends to be like cancer," Eftimiades said. "Once it gets into the body, it looks to spread and looks to reach out."

The playbook is not new, he added, "particularly for China." Any executive dealing with the country "will tell you that they've been approached." He cited "tons of diplomat stories" of U.S. diplomats finding a woman on the bed in a hotel room. What is newer than Soviet-era spying is duration. Cultivated relationships now often last years, not weeks.

Technology can augment human intelligence. Eftemiades pointed to IMSI catchers, devices that mimic a cell tower so nearby phones connect to them. A basic version costs about $1,000 and fits in a suitcase. Government-grade models cost far more.

No one knows yet whether such tools were used against Huang. His phone was presumably hardened so compromises could be detected, if not stopped. What Nvidia's security team knew, and whether it could have acted, should become clearer as the board's independent investigation and federal inquiries proceed.

Eftimiades hopes the episode is "a wake-up call" for U.S. industry, which he called mostly "clueless" about China's tactics. "We have lost trillions [of dollars] in intellectual property," he said. "Whatever we think we're doing isn't working."