As Jensen Huang's affairs surface, experts warn corporate security teams are woefully unprepared to counter Chinese intelligence operations targeting executives.
By Adam Makins·
The sudden departures at Nvidia’s security office this year raise uncomfortable questions about what the company knew and when it knew it. Chief Security Officer David Reber stepped down in August citing health reasons, followed months later by CEO Jensen Huang himself, whose exit came amid investigations into his extramarital relationships including one with an executive at Megaspeed, a Singapore data center company under federal scrutiny for allegedly funneling Nvidia chips to China.
While Reber cited a young-onset Parkinson’s diagnosis and his successor Saša Zdjelar arrived from a career in corporate IT security, nothing publicly connects these transitions to the growing scandal. Yet the timing begs a question security experts are increasingly comfortable asking: what should Nvidia’s security apparatus have caught, and why didn’t it?
Retired intelligence officer Nicholas Eftimiades, who has trained over 1,000 corporate security professionals, explains that foreign intelligence services don’t primarily rely on hacking or surveillance technology. They cultivate relationships. A CEO’s affair, particularly one involving someone at a company under federal investigation, represents exactly the kind of leverage that makes an executive vulnerable to coercion.
Huang’s relationship with a Megaspeed executive wasn’t an internal HR matter. It was a potential national security concern. Yet spotting such risks remains astonishingly difficult for corporate teams. “Much of it is through everyday conversation rather than hacking,” Eftimiades notes. Intelligence services identify obstacles to their goals, find who’s blocking policy changes, then target those people.
The playbook is particularly well-honed by China. Eftimiades observes that unlike Cold War-era Soviet operations that lasted weeks, modern Chinese intelligence cultivates relationships spanning years. “Any executive dealing with the country will tell you that they’ve been approached,” he says.
The uncomfortable truth is that most companies, even tech giants, define security too narrowly. According to corporate investigations experts Don Aviv and Jeremy Hurewitz, companies still treat security as primarily about “protecting facilities, preventing cyberattacks, and responding to physical threats.” What they miss are insider threats, suspicious business relationships, and the deliberate cultivation of executives by foreign intelligence services.
Then there’s the resource problem. Security teams are chronically underfunded because, unlike revenue-generating departments, they’re viewed as cost centers. CEOs famously respond to security warnings with “not a nickel more than compliance,” Eftimiades notes dryly.
Nvidia’s security team may have had a broader mandate than most companies given its scale and sensitive partnerships, but that’s speculation. What we know is that Nvidia’s top lawyer was engaged with the government’s Megaspeed inquiry more than a year ago, suggesting legal and compliance knew pieces of the puzzle. Multiple news outlets reported that Nvidia employees were aware of Huang’s relationships. Whether any of this reached security leadership remains unclear.
Technology plays a role, though perhaps not the starring one most assume. Eftimiades points to IMSI catchers, devices that mimic cell towers and force nearby phones to connect to them. A basic model costs about $1,000 and fits in a suitcase. Government-grade versions cost far more, and Chinese espionage operations deployed them at least a couple of times last year.
Whether such devices were used against Huang is unknown. But here’s what matters: corporate America remains largely clueless about these tactics. Eftimiades estimates the nation has “lost trillions in intellectual property” to espionage, and our current defensive posture clearly isn’t working.
The board’s independent investigation and federal inquiries will eventually reveal what Nvidia’s security team knew, when they knew it, and what they should have done differently. But the real question extends far beyond one company or one executive. If a tech leader at Nvidia couldn’t be protected from foreign intelligence operations, what hope do other corporations have?
Source: TechCrunch
The episode serves as a wake-up call that our corporate defenses aren’t just inadequate, they’re dangerously outdated.
