Reporting Foreign Relationships Under SEAD 3: What the Nvidia Story Means for Cleared Employees
The Jensen Huang story as a SEAD 3 test case: which relationships with foreign nationals cleared employees have to report, and when.
On October 29th, the New York Times reported that U.S. intelligence officials believe Alice Huang (also known as Huang Le), a former executive at the Singapore data center company Megaspeed, was gathering information on Nvidia CEO Jensen Huang for China’s Ministry of State Security. U.S. authorities have reportedly been looking into Megaspeed since 2024 to determine whether it helped Nvidia chips reach China in violation of export controls. On November 8, Huang acknowledged a personal relationship with a business executive he didn’t name and apologized to Nvidia staff. Nvidia’s board has opened an independent investigation.
Nothing reported so far says Huang holds a security clearance. The part of the story that matters for cleared employees is how it started: a customer relationship with a foreign national that became personal at a company whose products a foreign government wants. Most cleared people know they must report foreign travel. Far fewer know which foreign relationships they have to report.
The short answer for clearance holders
If you hold a clearance at any level, Security Executive Agent Directive 3 (SEAD 3) requires you to report a continuing association with a known foreign national that involves “bonds of affection, personal obligation, or intimate contact.” That covers close friendships, family and in-laws, relationships where one person owes another something, and dating. It also covers recurring contact in which you exchange personal information. How you met or whether the relationship started out as business is irrelevant. You must report any unofficial contact with a known foreign national that involves bonds of affection, personal obligation, intimate contact, or where the contact involves the exchange of personal information.
Report before the activity if it’s planned, or as soon as you can once it starts. After that, you must update the report only when the relationship changes significantly.
How SEAD 3 reporting works
SEAD 3 took effect June 12, 2017. It covers anyone who works for or on behalf of the executive branch and has access to classified information or holds a sensitive position, and it expressly includes contractors, subcontractors, and consultants. For cleared contractors, 32 CFR 117.8(a) pulls SEAD 3 into the NISPOM reporting requirements, so the company’s security program is responsible for carrying it out.
| What gets reported | Who | SEAD 3 cite |
|---|---|---|
| Unofficial contact with a known or suspected foreign intelligence entity | All covered individuals | F.2.b(1) |
| Continuing association with known foreign nationals involving affection, obligation, or intimate contact, or contact that involves exchanging personal information | All covered individuals | F.2.b(2) |
| Unofficial foreign travel (itinerary in advance; deviations within five business days of return) | All covered individuals | F.1 |
| Attempted elicitation to obtain access to classified information, media contacts where access to classified information is sought, arrests, bankruptcy, and alcohol- and drug-related treatment | Secret, Confidential, and L holders, and above | G |
| Foreign national roommate for more than 30 days, cohabitant, marriage, foreign bank accounts, direct involvement in a foreign business | Top Secret, Q, and critical or special sensitive positions | H |
The relationship requirement turns on the nature of the relationship, not the setting. This requirement applies to relationships that are in-person and Internet-based. Limited or casual public contact with foreign nationals doesn’t need to be reported. Section E.2 asks that the report be made before you take part in the activity or as soon as possible after it begins. Section E.3 states that failure to report can result in administrative action, including revocation of your security clearance.
DCSA’s contact reporting guidance for contractors provides a practical test for the personal-information clause: you know the person’s name and nationality; you’ve shared information about yourself that isn’t public; and the contact is recurring or you expect it to be. The same guidance carves out ordinary commercial transactions and routine professional and personable interactions.
The contractor has its own duties in addition to the employee’s. Under 32 CFR 117.8(c)(2), a cleared contractor must report suspicious contacts to DCSA. That includes attempts by anyone of any nationality to elicit information from a cleared employee, and any contact suggesting that the employee may be the target of exploitation by a foreign intelligence service. Actual or suspected espionage is reported to the FBI under 117.8(b), with a copy of the report sent to DCSA.
On the adjudication side, SEAD 4 Guideline B (foreign influence) asks whether a foreign tie could leave you open to manipulation or pressure. One of its mitigating conditions is that the contact is casual and infrequent. A reported foreign friendship or in-law relationship gets weighed under that guideline like any other foreign tie.
Where cleared employees get this wrong
Assuming only romance counts
“Bonds of affection” reads like dating language, so a lot of people stop there. The phrase also covers a close friend from grad school you still talk to every week, a former coworker at a foreign partner firm you visit when you travel, and your spouse’s parents overseas. “Personal obligation” covers ties where one of you is in the other’s debt: a foreign contact who helped your kid land an internship, lent you money, or arranged a favor you’d feel awkward refusing to return. There’s nothing suspicious about any of these, but each is a tie someone could later use to ask for something, and that’s what the reporting requirement is intended to address.
Treating it as a business contact
According to reports, Huang told Bloomberg in late October that his interactions with Alice Huang related to Megaspeed’s business and were normal. Whatever the facts turn out to be, that’s how many cleared people think about a foreign customer, a supplier’s sales lead, or a co-author at a foreign university. The contact starts in a meeting, so nobody thinks of it as reportable. Under SEAD 3, it becomes reportable once there’s real friendship, obligation, or intimacy, or you’re regularly swapping personal details. Dinners, family conversations, and staying in touch between projects are the usual signs that a professional contact has become a reportable one.
Assuming it’s a Top Secret rule
The relationship item sits in Section F, which applies to every covered individual. The items limited to Top Secret and Q are narrower: foreign roommates, cohabitants, and marriage. An engineer with a Secret clearance who has a close friendship with a foreign national needs to report it.
Feeling like a report accuses your friend
People put off reporting a foreign friend or relative because it feels like calling them a spy, but the relationship item doesn’t depend on any concern about the person; in most real cases, there isn’t one. Someone who has been targeted usually doesn’t know it either, which is why the rule is built on the relationship and not on what you know about the other person’s affiliations. You report the relationship, and the security office and counterintelligence people run the checks you can’t.
Waiting for the government to warn you
An Nvidia spokesperson said the company trusts the government would have notified them if it was the target of a real threat. A cleared contractor can’t take that approach. Section 117.8(c)(2) puts the reporting duty on the company, and the government often learns about a threat from contractor reports in the first place. The Megaspeed angle is a reminder that the reportable relationship can come through a customer. If a foreign customer or partner keeps steering toward a particular engineer or executive, that’s worth a suspicious contact report, and if technical data could come up in those conversations, it’s an export control question too.
What to put in your program
- Brief all cleared employees, Secret included, that friendships, family ties, and personal obligations with foreign nationals are reportable, not just romantic relationships.
- Use realistic examples in your training program, like a customer’s account manager who has become a friend or a contact that started online, so people see that the trigger is the nature of the relationship, not where it started or any suspicion about the person.
- If a foreign customer or partner keeps working toward one senior engineer or executive, report it to DCSA as a possible suspicious contact under 117.8(c)(2), and include executives in the same briefing as everyone else.