As palm trees swayed in the ocean breeze, Yujing Zhang approached Secret Service agents in the Mar-a-Lago parking lot.
She said she was going to the swimming pool at the Palm Beach presidential estate and presented agents with two Chinese passports in her name. That raised suspicions with her screeners, but a call to the front desk at Mar-a-Lago revealed a club member with a similar last name and with that, and a possible language barrier, she was waved through.
Not long afterward, Zhang was arrested carrying four cellphones, a laptop computer, an external hard drive and a thumb drive containing computer malware in an incident that is shining a spotlight on the unique difficulty of fortifying the oceanside Florida estate of President Donald Trump — who was staying at the club that weekend but golfing elsewhere at the time.
Zhang's arrest has revived concerns about security — particularly cybersecurity — at a presidential refuge that mixes social functions, world diplomacy and extraordinary access to the president. Hundreds of members frequent Mar-a-Lago and the president's other private clubs, which function as working resorts even when Trump himself visits, creating a series of challenges that test the Secret Service.
Federal officials were looking into whether Zhang was part of a larger effort to gain access to the president and do potential harm, and were combing through her devices and treating the case as a "credible threat,'' according to a U.S. official who was not authorized to speak about the probe and discussed the matter on condition of anonymity.
Link to donor?
Democratic lawmakers were inquiring about a possible connection to Li Yang, the Republican donor and spa owner who promised Chinese business leaders that her consulting firm could get them access to the president at Mar-a-Lago.
Democrats on Wednesday called for an investigation into security at Mar-a-Lago, and whether classified information stored there is at risk from hostile foreign governments. House Oversight Committee Chairman Elijah Cummings, D-Md., said he would get a briefing Thursday from the Secret Service.
"We want to make sure that the Secret Service is being the very best that they can be, and we want to find out more about exactly what kind of security they had down there in Florida,'' Cummings said. "I think it's very, very, very, very important that the president be protected. And I feel very strongly about that.''
Trump on Wednesday dismissed the incident, saying it was "just a fluke situation.''
"We have very good control,'' he told reporters.
With the Atlantic Ocean to the east and Florida's Intracoastal Waterway to the west, Mar-a-Lago sits on the Palm Beach barrier island, a 128-room, 62,500-square foot symbol of opulence and power. Long a Trump favorite since he purchased it from the foundation of the late socialite Marjorie Merriweather Post in 1985, the president travels to the estate every few weekends during its winter high season, abandoning Washington's chill for Florida sunshine.
"For the president, I think Mar-a-Lago is not so much a club, but his Xanadu,'' said Chris Ruddy, publisher of Newsmax and a longtime club member and Trump friend. "My feeling is he also sees it as place of destiny and fate because Mrs. Post wanted it as the winter White House.''
While there, Trump has been known to crash weddings, pop in on charity events and, one time, order airstrikes.
A place for business
He has not been shy about conducting government business there. It was while hosting Chinese President Xi Jinping that Trump, over a chocolate cake dessert, authorized a missile launch at Syrian airfields after a chemical attack. On another occasion, he and Japanese Prime Minster Shinzo Abe sat on an outdoor patio, as guests dined nearby, and reviewed options for responding to a North Korean ballistic missile test.
Such interactions could make Mar-a-Lago a tempting target, particularly for cyberattacks.
"Mar-a-Lago has not been sufficiently well-defended against not just physical attacks, but against counterintelligence exploits, including digital attacks,'' said David Kris, an authority on foreign intelligence at Culper Partners, a consulting company in Seattle.
Federal agencies spent about $3.4 million per Trump visit, much of it on security, according to an analysis done by the U.S. Government Accountability Office of four 2017 trips. The Secret Service doesn't decide who is invited or welcome at the resort; that responsibility belongs to the club. Agents do screen guests outside the perimeter before they're screened again inside.
The agency said in a statement that, with the exception of certain facilities that are protected permanently, like the White House, "the practice used at Mar-a-Lago is no different than that long used at any other site temporarily visited by the president.''
But Mar-a-Lago is different from other presidential retreats.
Unlike Ronald Reagan's and George W. Bush's ranches or George H.W. Bush's seaside vacation home in Maine, Mar-a-Lago is open to members who pay $14,000 annual dues after a $100,000 or $200,000 initiation fee. They expect access to the facility and want to host their equally affluent guests — and they are used to getting their way.
Nabil Erian, a former Marine and government counterintelligence officer, said guarding Mar-a-Lago is a "nightmare.''
"If this venue was uniquely for the president, it is easier to manage the perimeter,'' said Erian, an executive at the security firm CTC International Group in West Palm Beach. Because Mar-a-Lago is a club and not just a home, "frankly, it increases the risk of something like this happening.''
Zhang changes story
Last Saturday, Zhang changed her story at the indoor reception desk, saying she was there a little early to take photos, but had come to attend a "United Nations Friendship Event'' between China and the U.S., which didn't exist.
Zhang also told agents she was at the club because her Chinese friend "Charles'' told her to travel from Shanghai to Palm Beach and that if she attended the event she could speak with a member of the president's family about Chinese and American foreign economic relations, according to the complaint.
A man named Charles Lee ran the United Nations Chinese Friendship Association, and was photographed at least twice with Yang, the spa owner whose website advertised access to Trump.
Yang's attorney said she did not know Zhang, and merely attended two of the same events as Lee. But the Miami Herald reported that Lee recruited people for Yang's events. The criminal complaint made no mention of a possible connection.
Zhang was charged with making false statements to federal agents and illegally entering a restricted area. She remains in custody pending a hearing next week. Her public defender, Robert Adler, declined to comment.
General club access doesn't mean access to Trump or his guests. When Trump is at Mar-a-Lago, more screening and security measures are required.
"I really think it's overblown. There is a lot of security and the staff is wonderful,'' said Toni Holt Kramer, a nine-year member of the club and founder of the group "The Trumpettes.'' "Mr. Trump wants us all to feel right at home there.''
