Op-ed: In Nvidia CEO Jensen Huang's alleged China spy scandal, there's plenty of blame to go around

In June 2013, President Barack Obama welcomed Chinese President Xi Jinping to Sunnylands, a secluded California estate, for an informal summit. Behind the diplomatic pleasantries, Obama confronted Xi over Chinese state-directed cyber-enabled espionage and theft of American intellectual property, warning that such activities threatened American companies and the broader bilateral relationship.

Thirteen years after the Sunnylands Summit, the threat has evolved significantly as the race to dominate AI frames the U.S.-China relationship. The stakes are higher, the technology more consequential, and the vulnerabilities increasingly involve attempts to compromise or coopt the "key man" at the helm of the nation's top technology companies.

With the unfolding scandal involving Nvidia CEO Jensen Huang, the blame should start with the CEO himself, but it should not end there. The situation illustrates a failure of Silicon Valley, corporate and political leadership at a much wider level.

Huang has acknowledged an extramarital affair with a woman identified in reporting as Alice Huang, a former executive at Singapore-based Megaspeed, an Nvidia customer. American intelligence officials reportedly believe she was recruited by China's Ministry of State Security to gather information and potentially influence Nvidia's efforts to loosen American semiconductor export restrictions. China denies the allegations.

Nvidia's independent directors have launched an investigation, and so far, they say no compromise of company secrets or national security information has been established. But the problem extends well beyond Huang or Nvidia. Focusing exclusively on whether proprietary technology or trade secrets were transferred fundamentally misunderstands the potential intelligence value of such an operation.

For Beijing, gaining insight into, influencing, or potentially compromising American technology policymaking could be equally valuable. Advance knowledge of export-control deliberations, regulatory intentions, negotiating positions, or divisions within the administration could provide strategic advantages without a single semiconductor design being stolen.

The Trump administration reportedly received warnings about the relationship before the scandal became public. Nevertheless, Huang remained an influential participant in semiconductor policy discussions while advocating greater access to China's market.

New reporting also raises questions about interactions between Nvidia and Commerce Department officials during an investigation into Megaspeed, subsequently transferred to the Justice Department. No improper influence has been established, but corporate access to government decision-making deserves scrutiny alongside proprietary technology.

It is a new era of 'key man' risk with AI

Whether appropriate protective measures were taken remains unclear. President Donald Trump's public defense of Huang — saying that Huang told him he had no idea the woman could be a spy and that he trusted the CEO, and that if national intelligence had warned the president about this threat, as has been reported, he didn't remember — hardly conveyed the urgency warranted by allegations of a foreign intelligence operation targeting a strategically indispensable American company.

Trump has met Xi three times since returning to office, with two additional encounters anticipated in November and December. These meetings offer Trump an opportunity to follow Obama's example by confronting Xi directly over Chinese state-directed or sponsored espionage targeting American technology companies, their executives, and potentially the U.S. policymaking process.

It is also time for a more formal check from Congress on Silicon Valley, which has long celebrated the visionary founder, the indispensable executive whose genius supposedly transcends conventional corporate management and traditional corporate governance. Investors have rewarded this concentration of authority, while boards have all too frequently accommodated it.

Corporate governance professionals call this "Key Man" risk: excessive organizational dependence on an individual whose departure, financial misconduct, or moral compromise could materially damage the enterprise. In the artificial intelligence era, this risk becomes considerably more dangerous. When a handful of executives control technologies central to America's economic competitiveness, military capabilities, and intelligence advantages, their personal vulnerabilities become potential national security vulnerabilities.

When those executives also enjoy extraordinary access to the White House and senior policymakers, they become potential conduits for foreign intelligence collection and influence directed not simply at their companies, but at the American people and American policy itself.

How Congress can act to take back control from Silicon Valley

Congress has opportunities to strengthen America's defenses and must act immediately.

The AI OVERWATCH Act would strengthen oversight of advanced semiconductor exports and associated national security licensing conditions.

The MATCH Act would address weaknesses in restrictions on advanced semiconductor manufacturing equipment, including foreign suppliers and servicing arrangements.

The Chip Security Act would strengthen mechanisms for tracking advanced chips and detecting diversion.

Importantly, the Remote Access Security Act would extend export-control authorities to certain remote access arrangements, including cloud computing, addressing the possibility that restricted American technological capabilities could be accessed without physically exporting the underlying equipment.

Together, these measures address important technological and regulatory gaps and vulnerabilities. But controlling chips, equipment, and computing access admittedly will not solve the human vulnerabilities problem — the so-called "Key Man" risks to U.S. technology supremacy and national security.

Most of these bills have a good amount of Congressional bipartisan support. However, they have encountered stiff resistance from the technology industry and their lobbyists, and some very detailed disagreements over specifics of export-control policy. There has also been uncertainty about White House support for these bills and an unwillingness by the Republican-controlled Congress to get on the wrong side of the White House. However, there is no doubt in my mind the Nvidia controversy has given supporters a new argument for action. The Democratic takeover of both chambers could further strengthen congressional oversight and an appetite for codifying much of this into law using these pieces of legislation.

There should also be a serious discussion among key U.S. government and corporate governance experts about whether strategically important technology companies need explicit board-level counterintelligence responsibilities, independent executive-security assessments, and confidential mechanisms for reporting foreign intelligence approaches to the appropriate channels.

This is not about morally policing executives' private lives. It is about recognizing that individuals controlling America's most sensitive technologies, and influencing the policies governing them, are valuable intelligence targets and assets if compromised.

Unfortunately, the Trump administration's broader philosophy appears to emphasize voluntary industry commitments and confidence in technology executives' ability to police themselves. Morality is not a governance system. Personal assurances are not counterintelligence safeguards. Importantly, shareholder interests are not always synonymous with the national interest.

Obama understood at Sunnylands that protecting American innovation required confronting China directly. That engagement helped to clearly articulate American redlines against cyber-enabled theft of intellectual property for commercial advantage.

Trump now has an opportunity, and a responsibility, to extend that principle to today's intelligence threats. At his forthcoming meetings with Xi, he should make clear that state-directed or sponsored operations targeting American technology executives and attempts to compromise U.S. technology policymaking are unacceptable and carry consequences for the bilateral relationship.

But confronting Beijing is only half the responsibility. Washington must also confront weaknesses within the body of laws governing technology access and must weigh in on America's corporate institutions and governance.

America cannot declare artificial intelligence essential to national security while leaving protection of its technology, executives, and policymaking process primarily to corporate discretion. The greatest vulnerability in Silicon Valley may not be the technology we export, but the people and governance systems entrusted to protect it, and the policies determining who gets access to it.

Neither Congress nor the White House should be comfortable leaving that responsibility to Silicon Valley's own moral code.

—By Dewardric McNeal, Managing Director and Senior Policy Analyst at Longview Global, and a CNBC Contributor. He worked in the U.S. Department of Defense as an East Asia and China security relations expert during the Obama administration.