Malware arrest shows Trump’s serious security problems at Mar-a-Lago resort in Florida

Resort's computer system previously accessed by woman who changed screen saver to president's name preceded by an expletive, employee alleges

The arrest of a Chinese woman who carried a malware-laced device into Mar-a-Lago, President Donald Trump’s Florida resort, has exposed porous security at the private club and escalating tensions between Secret Service agents and the resort’s staff members, who vet guest lists and allow people onto the sprawling grounds.

At times neither side has had full clarity on who was entering Mar-a-Lago. Secret Service agents must rely on club receptionists and other employees to cross-check visitors, former officials said.

Communication breakdowns allow for security breaches – like the one on Saturday, when the woman, Yujing Zhang, 32, was arrested with four cellphones, a hard drive, a laptop and a malware-infected USB stick.

She said she was there to attend a “United Nations Friendship Event” that had never been scheduled.

Her arrest revealed gaps in Trump’s security and as well as the challenge of protecting a president who spends less time at the remote, fortified Camp David and more time at his busy resort with sometimes hundreds of guests.

The normally tight-lipped Secret Service was so disturbed by the breach that it issued an unusual statement that effectively blamed the Mar-a-Lago staff for not tightly tracking the comings and goings of guests.

“The Secret Service does not determine who is invited or welcome at Mar-a-Lago; this is the responsibility of the host entity,” the agency said in a statement late Tuesday.

“The Mar-a-Lago club management determines which members and guests are granted access to the property.”

The arrest of Zhang came against a backdrop of increasing interest in Mar-a-Lago in China, where advertisements on the internet and on social media sell invitations to the club, which also functions as a for-profit enterprise that rents itself out.

The advertisements promise the prospect of rubbing elbows with the president and his associates at banquets, fundraisers and other events.

Access to Mar-a-Lago is highly prized in China, bestowing respect, influence and the allure of potential business opportunities.

After Zhang was stopped, she produced a copy of a Chinese-language invitation for the friendship event that was promoted by Cindy Yang, who had previously owned a string of massage parlours where the police shut down a prostitution ring in February.

Authorities said the patrons included Robert Kraft, a friend of the president’s and the owner of the New England Patriots.

Yang, who is active in groups backed by the Chinese government and Communist Party, is no stranger to Mar-a-Lago herself. Last year, she attended a Trump fundraiser at the resort and posed for a photo with the president.

Federal officials said they were still investigating Zhang and what kind of malware was on her thumb drive.

It was not yet clear whether she was just a striver seeking selfies at the president’s resort or whether she had links to Chinese intelligence. Zhang’s lawyer did not respond to a request for comment.

Hotels owned by the Trump administration have come under cyberattack before; in 2015, credit card information was stolen from a number of Trump hotel properties. But that appeared to be criminal action, rather than the act of a state.

Some of the Chinese promoters of these events flaunt their connections to China’s ruling Communist Party and the department that promotes its foreign policy abroad, the United Front Work Department.

When the president is in Palm Beach, as he was on Saturday, agents must construct a government security system on top of what is essentially a private residence.

Questions about the process arose about a month after Trump assumed office in 2017, when resort guests took plain-sight photos of Trump and the Japanese prime minister discussing a North Korean missile launch.

Several Democratic lawmakers called for an investigation into how the club was vetting its visitors.

“The Secret Service relies on the club’s security who has the guest list to tell them who belongs and who doesn’t,” said Don Mihalek, executive vice president of the Federal Law Enforcement Officers Association, which represents the Secret Service.

“The Secret Service is not in the club membership business and does not have visibility on who these members are or what they’re entitled to,” said ​Mihalek, a former Secret Service agent who was assigned to Trump Tower during the 2016 campaign and presidential details from 2007 to 2011.

“That’s the standard for any protected site outside of the White House.”

On Wednesday, Trump praised the Secret Service and his staff at Mar-a-Lago for helping to catch the woman. “The person at the front desk did a very good job, to be honest with you,” he said.

A former employee who worked at Mar-a-Lago from 2016 to 2018 said that the arrest of Zhang was not surprising; people have been caught on the property previously.

In one notable example, a woman gained access to the Mar-a-Lago computer system and changed the automatic screen saver to the name of the president, preceded by an expletive, according to the employee, who spoke on the condition of anonymity for fear of legal retribution.

The former employee said security at the estate was not particularly strong, particularly when Trump was not there – a fact that was well known among the staff.

Joe Kirschbaum, who helped write a Government Accountability Office report on Mar-a-Lago security, said congressional inspectors received little help from the White House or the Trump Organisation.

He warned that it was not the responsibility of the Mar-a-Lago staff to keep Trump safe, and that the limited amount of information allowed to the Secret Service could create future problems.

In a letter on Wednesday, several Democratic senators asked Christopher Wray, the FBI director, to assess the security conditions at Mar-a-Lago.

“The latest incident raises very serious questions regarding security vulnerabilities at Mar-a-Lago, which foreign intelligence services have reportedly targeted,” wrote Sens. Chuck Schumer, Dianne Feinstein and Mark Warner.

The president has personally instructed members to pack fundraisers beyond the ticket limit at Mar-a-Lago, according to one event organiser who spoke on the condition of anonymity to share private conversations with Trump.

When the president is not at his club, the security bubble becomes easier to break.

Members and guests must still present identification and check in with the club’s security team, but several layers of Secret Service protection are not in place.

Laurence Leamer, a Palm Beach resident who wrote a book about Mar-a-Lago, said in an interview that the scene could be freewheeling, “like having dinner at the Outback Steakhouse,” adding that the security “seems to me to be incredibly lax”.

Trump was at his golf club four miles away when Zhang showed up at the resort Saturday, and the process that the Secret Service uses to check visitors when he is in town was in place, officials said.

Zhang was screened by agents before reaching the club’s reception area, but confusion over her name and a potential communication barrier led to her entering.

New York Times