Where Was Nvidia’s Security Team?

A Quiet Departure, Then a Sudden Storm

Outsiders had little reason to notice when Nvidia’s longtime chief security officer and head of product security stepped down in August. Just two and a half months later, CEO Jensen Huang himself left the company over growing questions about his extramarital relationships — starting with an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China, then widening to reports about two separate affairs with Nvidia employees.

At the time, David Reber, who spent four years as CSO and seven at Nvidia overall, said he was leaving for health reasons. “This wasn’t a pivot I had planned. But I know what needs to come first: family and health,” he wrote on LinkedIn in late August, disclosing that he’d been diagnosed with young-onset Parkinson’s more than two years earlier.

A New Security Chief With a Different Background

Reber’s replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager before spending one year at Salesforce and several years at the cybersecurity company ReversingLabs. Zdjelar didn’t respond to questions Thursday about the transition or what the security team knew.

Nothing public connects Reber’s or Zdjelar’s role changes to the Megaspeed matter, but it seems fair to wonder what Nvidia’s security team knew about the government’s scrutiny of Megaspeed and about Huang’s relationships — and whether anyone raised concerns. Reber didn’t respond to questions Thursday. Nvidia also has not answered our related questions.

The Line Between HR and Security

Not all of those relationships are the business of the security team. Relationships with subordinates typically fall to HR, legal, and the board. But an affair with an executive at a company under federal investigation is a different animal. (Megaspeed has denied any wrongdoing.) Security specialists say affairs can create vulnerabilities that foreign intelligence services look to exploit.

Catching that kind of exposure isn’t easy. The way intelligence services collect information — much of it through everyday conversation rather than hacking — makes it especially difficult for security teams to identify risks, according to retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals.

What Insiders Knew

Some people inside Nvidia clearly knew parts of the picture. Nvidia’s top lawyer was engaged with the government’s Megaspeed inquiry more than a year ago, The New York Times reported earlier this week. (Nvidia has said it regularly contacts officials.) Reports about Huang’s relationships with employees suggest colleagues also knew of them, even if the behavior is not expressly forbidden by Nvidia’s code of conduct. The Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship. What’s unclear is whether any of that reached security.

Security Teams Are Often Underfunded and Narrowly Defined

Even if it had reached Nvidia’s security team, Eftimiades, who wrote Chinese Espionage Operations and Tactics in 2020, said a security team’s resources are often limited. For one thing, they’re often underfunded because, unlike some other cost centers, they don’t drive revenue. It’s astonishingly common for CEOs to answer a security team’s warnings with “not a nickel more than compliance,” he said.

Many companies also define security very narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz, wrote, “Too many companies still approach security primarily as a matter of protecting facilities, preventing cyberattacks, and responding to physical threats.” The two argued that “[s]ecurity teams need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest and attempts to obtain sensitive information through trusted personal contacts.”

Still, some of it is beyond what any team can control.

via TechCrunch AI