On November 8, Nvidia's board opened an independent investigation involving its own CEO, Jensen Huang. According to reports, U.S. intelligence believes a person close to him was passing information to Beijing. The investigation is ongoing and nothing has been proven. Even so, the case already offers governance lessons for any company, of any size.
What we know so far
- A committee of independent directors, working with outside counsel, is leading the review. Huang remains in the role and says he supports it.
- The board says it has "no reason to believe" that company secrets or national security were compromised.
- Huang acknowledged the relationship in a memo to staff. Earlier, the company had said his interactions with this person were not unusual.
- The case touches Megaspeed, a Singapore company that buys Nvidia chips and, according to The New York Times, is under Commerce Department investigation over whether it helped Chinese companies get around export restrictions.
- Nvidia shares fell 4.27% on November 9, and lawmakers from both parties are calling for congressional investigations.
I won't discuss anyone's personal life. What interests me is what the case reveals about risk.
Lesson 1: the key person is an architecture risk
Huang co-founded Nvidia in 1993 and, according to Big Technology, has about 60 direct reports. In data systems, we'd call that a single point of failure.
I know the problem at a smaller scale. When I founded Qonteo in 2020, I led the entire stack with a team of four engineers. In a company that size, dependence on one person is obvious. In giant companies, it hides behind the org chart, but it's still there.
Lesson 2: the most likely leak is carelessness
As Bill Bishop of the Sinocism newsletter noted, quoted by Big Technology, sensitive information can leak without anyone intending it: an unlocked phone, an open laptop, a conversation in the wrong place. Security isn't just firewalls. It's least-privilege access, protected devices and habits that apply at the top too.
I did this exercise this week, on this site's own infrastructure. An access key I used day to day could read far more than it needed. Now each part of the system has only the permissions it needs. If that holds for a small website, it holds even more for an executive who speaks directly with heads of state.
Lesson 3: know your partners
Megaspeed buys Nvidia chips and is under investigation over exports. At WEX, a US payments company, I worked on data governance aligned with financial regulations, and the logic is the same: anyone with access to your data or products needs ongoing due diligence, not a one-time check at contract signing.
Lesson 4: the first version of the story matters
According to Fortune, the investigation could examine earlier statements from the CEO and the company. In a crisis, credibility is an asset you lose quickly. The rule is simple: say what you know, say what you don't know, and correct early.
What remains
Nobody knows yet how this case will end. But the question it leaves for any leader is clear: if the most important person in your company were the weak link, what would happen tomorrow?
Sources
- CNBC: Nvidia investigates CEO Jensen Huang's relationship with alleged Chinese spy
- CBS News: Nvidia investigates CEO Jensen Huang
- Fortune: Nvidia board's probe could look at questionable statements
- CNBC: Nvidia stock falls 4% as scrutiny turns to Jensen Huang
- CNBC: Bipartisan congressional scrutiny
- TipRanks / The Fly: Megaspeed investigated by U.S. officials, NY Times reports
- Big Technology: The Jensen Huang Honeypot Fallout