Cyber Incident Victim: Donald Trump
Date:
Mar 2019
Location:
United States of America
Summary
A Chinese national, Yujing Zhang, was arrested attempting to enter Mar-a-Lago with electronic devices including a malware-infected thumb drive, claiming attendance at an event promoted by entrepreneur Li "Cindy" Yang, who had previously advertised access to the club's gatherings. Federal authorities launched a counterintelligence investigation into potential Chinese intelligence operations targeting the property, examining possible links between Zhang and Yang's activities. The incident raised concerns among congressional Democrats about security vulnerabilities at the club, particularly regarding visitor screening processes and foreign exploitation of public access while the president was present. The Secret Service stated access determinations were made by club management, not their agency, and emphasized standard security protocols were followed during Zhang's apprehension after she provided conflicting reasons for entry and became aggressive during screening.
| CIA Posture | Motives | Tactics, Techniques & Procedures |
|---|---|---|
| Available to members | 2 motives | 1 technique |
| Threat Actor | Type | Location |
|---|---|---|
| 1 actor | Available to members | Available to members |
Description
On March 30, 2019, Chinese national Yujing Zhang attempted to enter President Donald Trump’s Mar-a-Lago club in Palm Beach, Florida, while Trump was golfing at another nearby property. Zhang arrived at an exterior checkpoint around noon, presenting two Chinese passports and claiming she wished to use the club’s pool. Secret Service agents allowed her entry after initial screening, but Mar-a-Lago staff later discovered she was not on the guest list for any scheduled events. During a secondary security screening, agents found Zhang carrying multiple electronic devices, including four cell phones, a laptop, an external hard drive, and a thumb drive later determined to contain "malicious malware." She provided conflicting statements about her intentions, alternately stating she wanted to discuss U.S.-China economic relations with a member of the Trump family. After becoming verbally aggressive with agents, Zhang was arrested on federal charges of making false statements to a federal officer and entering restricted property.
The incident triggered a federal counterintelligence investigation led by the FBI, which had already been examining potential Chinese intelligence operations targeting Mar-a-Lago prior to Zhang’s arrest. Investigators focused on possible links between Zhang and Li "Cindy" Yang, a South Florida businesswoman who had organized paid-access events at Mar-a-Lago for Chinese clients through her company. Zhang had reportedly been en route to a "United Nations Friendship Event" advertised on Chinese social media by Yang’s associate Charles Lee, though no such event was scheduled that day. Yang had previously promoted March 30 events at Mar-a-Lago—an "International Leaders Elite Forum" and a Safari Night gala—as opportunities for Chinese business executives to interact with Trump family members, though these were canceled after media scrutiny. The FBI sought to determine whether Zhang’s actions represented a coordinated intelligence-gathering effort exploiting Mar-a-Lago’s accessibility to non-members. Congressional Democrats, including Senators Mark Warner, Dianne Feinstein, and Chuck Schumer, demanded assessments of security vulnerabilities at the club, citing risks from foreign nationals gaining proximity to the president. President Trump dismissed concerns, calling the incident a "fluke situation," while China’s Houston consulate confirmed providing consular assistance to Zhang but denied knowledge of her affiliations. The Secret Service emphasized its standard screening protocols but noted Mar-a-Lago management—not federal agents—controlled initial access determinations.