Nvidia CSO exit and Huang departure put chipmaker's security team in the spotlight

Nvidia has lost both its chief security officer and its chief executive within a few months, and TechCrunch is now pressing a question the company has so far left unanswered: what did its security organization know about the controversies surrounding CEO Jensen Huang, and did anyone inside raise a concern?

David Reber, who served as Nvidia's chief security officer and head of product security, stepped down in August after seven years at the company, four of them leading security. Writing on LinkedIn, he said he was leaving for health reasons and disclosed that he had been diagnosed with young-onset Parkinson's more than two years earlier.

Roughly two and a half months after that departure, Huang himself left the company amid growing questions about his extramarital relationships, TechCrunch reports. The scrutiny began with an executive at Megaspeed, a Singapore data center company that U.S. investigators suspect of routing Nvidia chips to China, and then widened to reports of two separate affairs with Nvidia employees.

A quiet succession

Reber was replaced by Saša Zdjelar, whose background includes 17 years at ExxonMobil in Houston, where he left as a senior IT manager, a single year at Salesforce, and several years at the cybersecurity company ReversingLabs. According to TechCrunch, neither Zdjelar nor Reber responded to questions about the transition or what the security team knew, and Nvidia has not answered related inquiries either. TechCrunch also notes that nothing public connects either appointment or departure to the Megaspeed matter.

What the company knew and when

Nvidia's top lawyer had been in contact with the government's Megaspeed inquiry more than a year ago, The New York Times reported this week. Nvidia has said it communicates with officials regularly, and Megaspeed has denied any wrongdoing.

On Huang's relationships, The New York Times cited five Nvidia employees who said he was involved with a vice president who reported directly to him, and Reuters, citing two people, later reported a second relationship. TechCrunch notes that Nvidia's code of conduct does not expressly forbid such behavior. Relationships with subordinates ordinarily fall to HR, legal and the board, but a relationship with an executive at a company under federal investigation is a different category of risk, since security specialists say affairs can create openings that foreign intelligence services may try to exploit.

Why security teams struggle to catch it

Nicholas Eftimiades, a retired senior intelligence officer who says he has trained more than 1,000 corporate security professionals and wrote a 2020 book on Chinese espionage, told TechCrunch that intelligence services collect much of their information through ordinary conversation rather than hacking, which makes the resulting risks especially hard for security teams to identify. He added that security teams are often underfunded because they generate no revenue, and that CEOs frequently approve only the minimum that compliance requires.

In an opinion piece in The Hill, Don Aviv, CEO of the corporate investigations firm Interfor International, and author Jeremy Hurewitz argued that too many companies still treat security as protecting facilities, preventing cyberattacks and responding to physical threats. They contended that teams should pay far more attention to insider risks such as foreign cultivation of executives, suspicious business relationships, conflicts of interest and attempts to reach sensitive information through trusted personal contacts.

Eftimiades also pointed to IMSI catchers, devices that pose as cell towers and trick nearby phones into connecting; a basic model costs about $1,000 and is small enough to carry in a suitcase. He said nobody yet knows whether such tools were used against Huang, whose phone was presumably hardened enough that compromises could be detected, if not prevented.

Why it matters

Nvidia is the dominant supplier of AI chips, and U.S. export controls on those chips are among the most consequential technology policy questions in Washington. If the chief executive of that company was exposed, even inadvertently, through personal relationships, the potential stakes extend well beyond one firm. As the board's independent investigation and federal inquiries proceed, it should become clearer what Nvidia's security team knew and whether it could have acted. Eftimiades told TechCrunch he hopes the episode serves as a wake-up call for U.S. industry, which he described as largely oblivious to China's tactics and which he estimated has already lost trillions of dollars in intellectual property.