Why in the News
The chief executive of Nvidia is alleged to have been cultivated, through a personal relationship, by a person assessed as a Chinese intelligence asset, meaning someone acting for an intelligence service. The episode shows that strategic competition between countries now runs through ordinary commercial networks. Indian corporate governance does not yet treat the targeting of people and knowledge inside firms as a routine risk.
What risk does the Nvidia episode reveal?
- What it is: A foreign intelligence service cultivates a person, meaning it builds a relationship over time to reach what that person knows. It is like industrial spying done through friendships and business ties.
- Knowledge in private firms: The knowledge that matters most now sits inside private organisations, not state laboratories.
- Instruments of national power: Advanced process knowledge, design data and tacit expertise (unwritten know how held by key individuals) have become instruments of national power, so intelligence services seek out those individuals and their employers.
- Commercial channels: Cultivation proceeds through travel, partnerships, conferences, recruitment and personal association.
- The takeaway: Even in a company of exceptional scale and sophistication, one major customer relationship and one personal connection were enough to raise a national security concern.
What do the GE Aviation and DuPont cases show?
- GE Aviation: Yanjun Xu approached employees of GE Aviation through academic and professional channels.
- DuPont: Walter Liew used former DuPont personnel to obtain titanium dioxide technology.
- Common method: Xu and Liew both succeeded by exploiting the ordinary openness of global business, where people move, meet and share freely.
Why is India’s exposure distinctive?
- Strategic sectors: Indian firms are expanding in semiconductors, artificial intelligence (AI), aerospace components, telecommunications and advanced manufacturing. Larger powers treat these capabilities as strategic.
- Government warning: The government has publicly warned that India’s rising design and manufacturing capacity will be viewed as a threat. It has asked industry to prepare for cyber and other disruptions.
- Thinner buffers: Indian firms are still building their positions in global value chains (production spread across several countries), so they have fewer internal safeguards than a firm like Nvidia.
- Openness as exposure: The same openness that enables growth multiplies the opportunities for cultivation.
Why do Indian boards miss this risk?
- Geopolitical risk as an external constraint: Boards register geopolitical risk as external constraints, such as tariff changes, export controls, supply chain concentration and sudden regulatory shifts in major markets.
- No settled practice: Most boards lack a settled practice for assessing:
- which executives, engineers or researchers are points of leverage, the people through whom a firm’s knowledge can be reached;
- how overseas partnerships or customer relationships create opportunities for observation;
- how personal and professional networks can be turned to intelligence purposes.
- Functions in silos: Security, legal, human resources and business development teams work with limited shared visibility.
- People and relationships: The gap is not mainly in technical cybersecurity. What a firm must protect now includes its people and their relationships.
- Missing institutional response: Companies have not built internal arrangements in response to the government’s warnings.
Challenges
- Commerce and security: Reporting requirements can turn ordinary commercial activity into a security regime and deter legitimate partnerships.
- Protection lags capability: Indian capabilities are expanding faster than the arrangements needed to protect them.
- Hard to detect: Approaches arrive through legitimate conferences, recruiters and customers, so they look like normal business contact.
- Employee privacy: Monitoring the personal ties of key staff can intrude on privacy and damage trust within a firm.
Way Forward
- Standing board risk: Boards should treat the targeting of people and knowledge as a standing category of material risk (a risk serious enough for board attention), with regular assessment and accountability.
- No imitation of agencies: Boards need internal risk review, not intelligence functions of their own.
- Sector specific assessments: The government should give companies threat assessments for each sector in a form they can use.
- Reporting channels: The government should maintain channels through which firms can report suspicious approaches.
- Shared visibility: Security, legal, human resources and business development teams should review foreign partnerships and approaches together.
Conclusion
Strategic knowledge now sits with people in private firms, and Indian companies have not yet built safeguards around those people. Whether boards and the government make such protection routine before a serious compromise occurs remains unresolved.
Matching Previous Year Question
“[2021, GS3, 15 marks] Analyse the multidimensıonal challenges posed by external state and non-state actors, to the internal security of India. Also, discuss measures required to be taken to combat these threats”
