Nvidia’s board is investigating whether its CEO was the target of a foreign intelligence effort. I do not know what they will find. I do know how this kind of work is done, because I ran human sources in the FBI. The technical term is social engineering. All it means is that someone is working you. It is not a hack. It is a relationship, and every leader with access is on the receiving end of one sooner or later.

What happened at Nvidia

In late October, The New York Times reported that U.S. intelligence believes an executive at an Nvidia customer was passing information to Beijing while building a close relationship with Nvidia CEO Jensen Huang. Nvidia said the chip-diversion allegations behind the story had been investigated and debunked, and that meeting customers is part of a CEO’s job. The Hill has the summary.

On November 8, Huang told employees he had been unfaithful to his wife and apologized. The next day, the board opened an independent investigation, run by a committee of independent directors with outside counsel. The board says it has no reason to believe national security or company secrets were compromised. Business Standard has the timeline.

It has not stopped there. A shareholder has filed a securities class action against Nvidia and Huang in federal court in California, claiming investors were misled about the relationship (The D&O Diary has the filing). A U.S. senator has called on Huang to resign, and House committee chairs have asked him to a closed-door briefing, Forbes reports. A lawsuit is an allegation, not a finding.

The intelligence claims are reported, not confirmed. I am not going to guess what happened, and I am not going to judge a man’s marriage. I am here for the part I know something about.

Social engineering is a relationship, not a hack

In the FBI I ran human sources. Cases take years, so some of those relationships lasted years. A source has to trust you or you get nothing. So you build the relationship and you keep it alive. That is the job.

It is also the risk. I had two rules. Do not get too close. And never let the source pull information out of me. I was there to learn from them. They were not there to learn from me.

It is a delicate balance. Too cold and the relationship dies. Too warm and it goes somewhere it should not. I had to hold that balance on purpose, for years at a time, with people I needed.

Now turn it around. Everything I was careful about is what someone working you is hoping you are careless about. They want you close. They want you talking. And they are patient.

The insider threat nobody plans for is the leader

Companies spend real money on the insider threat. They watch the new hire, the contractor, the unhappy engineer. Almost nobody plans for the person at the top. But the leader has the most access, the most relationships outside the building, and the fewest people willing to ask an awkward question.

If you have access, you are a target. For a competitor. For a vendor who wants your roadmap. Sometimes for a government. Most of the people you deal with are exactly who they say they are. That is what makes the exception hard to see.

You may be thinking, I do not have secrets anyone wants. You have more than you think. You know who is getting promoted, who is on the way out, and what your boss said behind a closed door. Nobody needs to be a spy to get that out of you. It happens when you vent to a vendor over a drink. When you tell one direct report what you really think of another. When a friendship gets close enough that you stop noticing what you share. Careless is enough. The damage is the same. Your people learn their business is not safe with you.

When you lead, there is no private mistake

Here is the leadership half. Your access is the company’s access. Your judgment in a private relationship is the company’s exposure. Whatever the board finds, Nvidia has lost hundreds of billions of dollars in market value, its shareholders are in court asking what they were not told, and tens of thousands of people who did nothing wrong are carrying it. That is what a leader’s private judgment costs when it fails.

Two things were handled the way I would want them handled. Huang apologized in plain words and did not blame anyone. And the board did not investigate itself. It handed the question to independent directors and outside counsel. I wrote two weeks ago about integrity when the truth is expensive. This is the same test, at a larger scale.

Apply it this week

1. Find the last slip. Think of the last thing you told someone that was not yours to tell. A colleague’s news. A number. What your boss really said.
2. Ask why you said it. To be liked? To look like you were in the know? To fill a silence? That feeling is the opening.
3. Notice the feeling. Four times a day, write down what you feel. That is the Element One homework, and it is how you catch the pull before you act on it.
4. Use one question. Before you share anything about someone else, ask: does this person need it to do their job? If not, keep it. You can stay warm and still say less.

Take it to your team

Three questions to read out loud Monday morning. Let the room answer.

1. Question one. Who outside this company knows more about our plans than they need to?
2. Question two. Where do we share information to build a relationship, when the relationship does not need it?
3. Question three. If someone were working one of us for information, how would we notice?

Nvidia’s board will finish its work and report what it finds. Until then, the lesson does not depend on the outcome. Social engineering works on people who believe it only happens to someone else. Build the relationships your job needs. Keep the line where you put it.

Keep your eyes on the target. — Errol