Nvidia CSO and CEO Departures Amid Megaspeed Probe Questions

“This wasn’t a pivot I had planned. But I know what needs to come first: family and health,” David Reber wrote on LinkedIn in late August, disclosing that he’d been diagnosed with young-onset Parkinson’s.

The Tech TL;DR:
• Nvidia’s longtime chief security officer David Reber departed in August due to health reasons, followed months later by CEO Jensen Huang leaving the company over growing questions about his relationships.
• Federal investigators are probing Megaspeed, a Singapore data center firm suspected of funneling restricted Nvidia chips to China.
• Industry specialists emphasize that corporate security teams must broaden their focus beyond physical facilities and malware to address insider threats and foreign intelligence cultivation.

Outsiders had little reason to notice when Reber, who spent four years as CSO and seven at Nvidia overall, stepped down in August. Just two and a half months later, CEO Jensen Huang himself left the company over growing questions about his extramarital relationships.

Those questions started with an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China, then widened to reports about two separate affairs with Nvidia employees. Megaspeed has denied any wrongdoing.

Reber’s replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager before spending one year at Salesforce and several years at the cybersecurity company ReversingLabs. Zdjelar didn’t respond to questions on Thursday about the transition or what the security team knew.

Nothing public connects Reber’s or Zdjelar’s role changes to the Megaspeed matter, but it seems fair to wonder what Nvidia’s security team knew about the government’s scrutiny of Megaspeed and about Huang’s relationships, and whether anyone raised concerns. Reber didn’t respond to questions on Thursday, and Nvidia has not answered related questions.

Affairs Create Vulnerabilities for Foreign Intelligence Services

Not all of those relationships are the business of the security team. Relationships with subordinates typically fall to HR, legal, and the board. But an affair with an executive at a company under federal investigation is a different animal. Security specialists say affairs can create vulnerabilities that foreign intelligence services look to exploit. Catching that kind of exposure isn’t easy.

The way intelligence services collect information, much of it through everyday conversation rather than hacking, makes it especially difficult for security teams to identify risks, according to retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals.

Some people inside Nvidia clearly knew parts of the picture. Nvidia’s top lawyer was engaged with the government’s Megaspeed inquiry more than a year ago, The New York Times reported earlier this week, while Nvidia has said it regularly contacts officials.

Reports about Huang’s relationships with employees suggest colleagues also knew of them, even if the behavior is not expressly forbidden by Nvidia’s code of conduct. The New York Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship. What’s unclear is whether any of that reached security.

Limited Resources Hinder Security Team Effectiveness

Even if it had reached Nvidia’s security team, Eftimiades, who wrote Chinese Espionage Operations and Tactics in 2020, said a security team’s resources are often limited. For one thing, they’re often underfunded because, unlike some other cost centers, they don’t drive revenue. It’s astonishingly common for CEOs to answer a security team’s warnings with “not a nickel more than compliance,” he said.

Many companies also define security very narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz, wrote that security teams need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest, and attempts to obtain sensitive information through trusted personal contacts.

Still, some of it is beyond what any team can do. Speaking generally, not about Huang, Eftimiades offered a hypothetical in which a CEO complains that he can’t do something because he is fighting a board that resists change.

That tells an intelligence asset who the obstacle is. The service then looks for ways into that person’s email and phone. What a rival intelligence service wants is often less technology than policy insight, including who’s pushing to change export rules and who the biggest blocker is.

“Intel world tends to be like cancer,” Eftimiades said. “Once it gets into the body, it looks to spread and looks to reach out.” The playbook isn’t new, he added, “particularly for China.” Any executive dealing with the country “will tell you that they’ve been approached.”

Technology Like IMSI Catchers Augments Human Intelligence

Technology can augment that human intelligence, Eftimiades said, pointing to IMSI catchers as one example. These devices mimic a cell tower so that nearby phones connect to them, with basic versions costing about $1,000 and fitting in a suitcase, though government-grade models cost far more.

Eftimiades says no one knows yet if these were used against Huang, whose phone was presumably hardened such that compromises could be detected, if not stopped altogether.

Either way, what Nvidia’s security team knew, and whether it could have acted on it, should become clearer as the board’s independent investigation and federal inquiries proceed. In the meantime, Eftimiades said he hopes the whole episode is “a wake-up call” for U.S. industry, which he said is mostly “clueless” about China’s tactics.

“We have lost trillions [of dollars] in intellectual property,” is his guess. “Whatever we think we’re doing isn’t working,” Eftimiades said.

Always consult with certified IT and cybersecurity professionals before altering enterprise networks or handling sensitive data.