Jensen Huang’s resignation from Nvidia after reports of an affair with an alleged Chinese spy is being treated as a one-off scandal. But that’s not the case. Over the past year, my private security firm, staffed largely by former intelligence and law enforcement officers, has handled a number of cases in which senior executives at U.S. technology companies had relationships with women who we believed worked for Chinese intelligence services.
The artificial intelligence industry faces a security problem that it does not yet fully understand. American companies are developing technologies with considerable commercial and national security value, but their defenses against foreign intelligence are, in most cases, far from sufficient. At the same time, the FBI counterintelligence teams that should help protect these companies are severely understaffed; some agents have been reassigned focus on administration (opens in a new tab) political priorities, while others have been purge (opens in a new tab). The result is a growing gap between the importance of technology and the quality of its protection.
An important part of this picture is the FBI’s counterintelligence posture. NPR (opens in a new tab)reported in October (opens in a new tab) that in many of the bureau’s 56 field offices, counterintelligence teams are only 50 to 60 percent staffed, while agents and analysts have been reoriented toward fighting violent crime and enforcing immigration laws. The FBI disputes that this weakened its counterintelligence operations. But it’s hard to believe that such reductions haven’t affected China-focused efforts — and they come at a time when U.S. AI and AI-adjacent businesses are more threatened than ever by foreign interference.
Investigating crimes is important, but keeping experienced counterintelligence personnel away is a dangerous business. Counterintelligence investigations are extremely complex and depend on accumulated knowledge and specialized judgment built over decades. This expertise is easy to lose and slow to rebuild. Intelligence history shows that it takes years to recover from political purges.
After 9/11, for example, the FBI redirected large numbers of agents from white-collar crime to counterterrorism. By the time the 2008 financial crisis hit, the bureau had fewer people investigating mortgage and securities fraud — a reason why so few responsible people were indicted.
In this new environment, technology companies cannot assume that government agencies will detect a suspicious relationship or intervene before valuable information leaves the organization. They need their own internal risk management programs to recognize and respond to foreign interference. But in my experience, much of the industry views anti-espionage protection as an extension of conventional cybersecurity or physical security, rather than for what it is: a separate investigative discipline that must apply across the entire enterprise, from the engineers who write the code to the data centers and supply chains — and, as the Huang case shows, must reach all the way to the top.
OpenAI saw some success this year when its internal teams detected buggy equipment (opens in a new tab)planted by a Saudi national; However, in most cases the company involved has no or no security team, and the warnings come from a concerned colleague. It’s luck, but it’s not a sustainable defense.
One reason companies neglect these operations is that foreign interference rarely seems urgent. A threat of death creates a clear reason to act. A relationship that gradually opens up access to sensitive information may appear ambiguous or commercially useful or be too uncomfortable to question. Executives may hesitate because they fear disrupting a business partnership or creating internal controversy. To be frank: spies don’t often look like spies.
This is why the attention of the board and management is important. Security teams can’t manage risks if leaders view them as peripheral. Companies must have a clear responsibility to evaluate suspicious approaches, preserve relevant evidence, and decide when an issue merits investigation. They must also accept that a credible investigation may produce impractical conclusions. A security team that lacks the authority to review sensitive relationships will struggle, regardless of its budget.
The practical starting point for a company that suspects it may be the target of foreign interference is to commission an independent review through outside counsel, supported by experienced investigators. Done properly, with work truly structured around legal advice, this arrangement can keep findings confidential, which is important when the subject of the investigation may be company management. The value lies in the combination of investigative skills and disciplined legal oversight.
Businesses should also not assume that their UK or EU operations are inherently protected from these risks. For a U.S. company, an overseas subsidiary or partner can become an indirect route to sensitive information. Security assessments must therefore track actual access across borders and corporate structures.
Ultimately, the AI boom has made American technology companies some of the most valuable intelligence targets in the world. Their defenses have failed to keep pace, and government agencies that might have detected what the companies missed are looking elsewhere. There has been much talk about the United States withdrawing from European defenses. Less noticeable is the US withdrawal of protection from its own technology companies.
Roderick Jones is executive chairman of Concentric, a security company based in San Francisco. He began his career in the Special Branch of Scotland Yard.
Gn bussni
