// TECHCRUNCH — FINANZA
Where was Nvidia’s security team?
Outsiders had little reason to notice when Nvidia’s longtime chief security officer and head of product security stepped down in August. Just two and a half months later, CEO Jensen Huang himself left the company over growing questions about his extramarital relationships — starting with an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of funneling Nvidia chips to China, then widening to reports about two separate affairs with Nvidia employees.
At the time, David Reber, who spent four years as CSO and seven at Nvidia overall, said he was leaving for health reasons. “This wasn’t a pivot I had planned. But I know what needs to come first: family and health,” he wrote on LinkedIn in late August, disclosing that he’d been diagnosed with young-onset Parkinson’s more than two years ago.
Reber’s replacement, Saša Zdjelar, previously spent 17 years at ExxonMobil in Houston, leaving as a senior IT manager before spending one year at Salesforce and several years at the cybersecurity company ReversingLabs. Zdjelar didn’t respond to questions Thursday about the transition or what the security team knew.
Nothing public connects Reber’s or Zdjelar’s role changes to the Megaspeed matter, but it seems fair to wonder what Nvidia’s security team knew about the government’s scrutiny of Megaspeed and about Huang’s relationships, and whether anyone raised concerns. Reber didn’t respond to questions Thursday. Nvidia also has not answered our related questions.
Relationships between a CEO and his employees typically fall to HR, legal and the board, not security. But security specialists say any affair — even one inside the office — can give a foreign intelligence service leverage over an exec who wants it kept quiet. And Huang’s relationship with an executive at Megaspeed, a company under federal investigation, wasn’t an office matter at all. (Megaspeed has denied any wrongdoing.)
Still, spotting the clues isn’t easy. The way intelligence services collect information, much of it through everyday conversation rather than hacking, makes it especially difficult for security teams to identify risks, according to retired senior intelligence officer Nicholas Eftimiades, who says he has trained more than 1,000 corporate security professionals.
Some people inside Nvidia clearly knew parts of the picture. Nvidia’s top lawyer was engaged with the government’s Megaspeed inquiry more than a year ago, The New York Times reported earlier this week. (Nvidia has said it regularly contacts officials.) Reports about Huang’s relationships with employees suggest colleagues also knew of them, even if the behavior is not expressly forbidden by Nvidia’s code of conduct. The Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship. What’s unclear is whether any of that reached security.
Even if it had reached Nvidia’s security team, Eftimiades, who wrote Chinese Espionage Operations and Tactics in 2020, said a security team’s resources are often limited. For one thing, they’re often underfunded because, unlike some other cost centers, they don’t drive revenue. It’s astonishingly common for CEOs to answer a security team’s warnings with “not a nickel more than compliance,” he said.
Many companies also define security overly narrowly, specialists say. In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz, wrote, “Too many companies still approach security primarily as a matter of protecting facilities, preventing cyberattacks, and responding to physical threats.” The two argued that “[s]ecurity teams need to pay greater attention to insider threats, including the cultivation of executives and employees by foreign intelligence services, suspicious business relationships, conflicts of interest and attempts to obtain sensitive i