China is striving for global leadership, and has the economic clout to realize its vision.

Federal authorities are probing possible Chinese intelligence operations targeting Donald Trump and his private Mar-a-Lago club, according to the Miami Herald. And as former members of the US and Russian intelligence communities tell Quartz, the president’s Palm Beach club provides unprecedented opportunities for spies to glean sensitive information.

The news of the investigation follows the weekend arrest of Yujing Zhang, a Chinese woman carrying two Chinese passports, four cell phones, a laptop, a hard drive, and a thumb drive loaded with malware who got past a security checkpoint at Mar-a-Lago, per a criminal complaint filed Monday (April 1) in federal court.

Trump was not at Mar-a-Lago during the incident—he had left for his golf club about two-and-a-half hours before Zhang was first approached by the Secret Service and returned about four hours later, according to White House pool reports. Trump stays at Mar-a-Lago when he is in Florida, and refers to it as the “Winter White House.”

The federal complaint says Zhang told Secret Service agents she had come to Mar-a-Lago to use the pool but she didn’t have a swimsuit with her when arrested. It is not yet known what Zhang, who was charged with trespassing and lying to federal agents, planned to do with the digital devices.

Zhang claimed she had traveled from Shanghai to Mar-a-Lago by invitation of a Chinese friend she identified only as “Charles,” and then said she was in fact at the resort for a “United Nations Friendship Event.” The event, which was no longer on the calendar, had been promoted by Cindy Yang, former owner of the Jupiter, Florida massage parlor where New England Patriots owner Robert Kraft was recently charged with soliciting a prostitute. Yang today runs a consulting business that sells Chinese clients access to president Trump and his family at Mar-a-Lago, according to the company’s website, which has now been taken down.

“Charles” is thought to be Charles Lee, a Chinese national with ties to the Chinese Communist Party and the head of a group called the United Nations Chinese Friendship Association, which is not affiliated with the UN. Zhang’s court-appointed lawyer, Robert Adler, did not respond to a request for comment. Lee could not be reached. Zhang is being held in the Palm Beach County Detention Center in West Palm Beach, law-enforcement sources told CBS News.

David Weinstein, a Miami defense attorney and former federal prosecutor, told the Miami Herald that Zhang’s alleged crime would have only been considered a simple trespass if Trump hadn’t been there.

Zhang is charged with making false statements to federal agents and unlawfully entering a restricted building or grounds. The charges carry potential five-year and one-year prison terms, and $250,000 and $100,000 fines, respectively.

Experts say the incident highlights the ease with which an enemy agent could use Mar-a-Lago as a conduit to get intelligence on the US.

“Foreign countries aren’t stupid,” former CIA analyst Cindy Otis tells Quartz. “They send officials to stay at Trump hotels for a reason. They know that he does not care about [operational security] and that he speaks openly and loudly about government issues wherever he goes, so foreign intelligence services are going to look for ways to monitor those conversations, either by gaining physical access or through electronic means.”

Trump appears almost as free with his words when at Mar-a-Lago as he is on Twitter.

In April 2017, he authorized a missile strike in Syria while in the Mar-a-Lago dining room with Chinese president Xi Jinping, enjoying what Trump later described as “the most beautiful piece of chocolate cake that you have ever seen.” He has also shown up at weddings there, unannounced.

During a February 2017 state visit by Japanese prime minister Shinzo Abe, Trump advisers huddled at a dinner table at Mar-a-Lago after a North Korean missile launch. Normally, such a sensitive meeting would be held in a highly secure location. This one was observed—and photographed—by a guest who also managed to get a selfie during his visit with a military aide appearing to carry nuclear-launch codes.

Trump, who sat nearby during the unfolding international security crisis, seemed entirely unperturbed by the goings-on.

“I don’t think this team has any appreciation about the vulnerabilities they are creating for themselves and how dangerous this is,” former White House deputy national security adviser Julianne Smith said at the time.

A club, not a fortress

Unlike Camp David, the Maryland retreat purpose-built for US presidents and their families, Mar-a-Lago—the former estate of Marjorie Merriweather Post, the socialite owner of General Foods—was not constructed or renovated with presidential security in mind. The resort spent $442,931 on security in 2016, according to a joint investigation by ProPublica and Gizmodo, far less than the $64 million spent by the Department of Defense the same year just on network upgrades alone at the White House and Camp David.

“As an intelligence officer, I don’t think it would be hard to place sources or technical collection devices in the facility,” says John Sipher, a former member of the CIA’s clandestine service who ran the agency’s Russia operations. “Someday they will write books about how difficult this president made it for them.”

White House spokesman Judd Deere referred Quartz to the Secret Service, which provided a statement that said the agency “does not determine who is invited or welcome at Mar-a-Lago; this is the responsibility of the host entity. The Mar-a-Lago club management determines which members and guests are granted access to the property.”

Secret Service agents are at Mar-a-Lago to ensure physical security, not to run background checks on members, guests or workers for counterintelligence purposes. They are screened for weapons, but do not undergo the same rigorous vetting as visitors to the White House, where agents run every visitor’s full name, date and place of birth, Social Security number, city of residence, and more.

Relatively unfettered access to Mar-a-Lago is available to anyone that can pay the $200,000 membership fee, and the club hires dozens of foreign workers each year. The White House has refused to release a comprehensive list of the Mar-a-Lago visitor logs.

“Whose responsibility is it to prevent foreign intelligence? That’s a very good question that remains unanswered,” one former Secret Service agent told Politico last year. “Is it the FBI? They’re not involved in protection. It’s not the CIA because they can’t spy on US citizens.”

Lists of club members have leaked, and the names and contact information of important Mar-a-Lago employees with access to the president—making them prime espionage or blackmail targets—are available on the resort’s website.

Complicating matters further, Mar-a-Lago plays host to various ticketed events and weddings throughout the year, all of which are open to the public. This would make it exceptionally easy to get close to a potential source or asset, explains Janosh Neumann, who was a member of Russia’s FSB, the successor agency to the KGB, before he defected to the US in 2008.

“From a security standpoint, it complicates matters when the ‘Winter White House’ is also a business establishment,” says former FBI agent Dennis Franks, who ran a multi-agency intelligence task force during his 22 years with the bureau.

A venue to explore

Cultivating a high-level source is incredibly time-consuming, and a foreign agent would be on the lookout for someone that will be active in politics for decades to come, says Joseph Wippl, a former CIA officer who spent his espionage career posing as a US diplomat.

“Both the Chinese and the Russians believe in the slow but long lasting approach,” he says. “They can take years but it works.”

Laurence Leamer, author of a book about Mar-a-Lago, told the Washington Post that Trump’s club has little security past the reception desk. “You can go anywhere. You’re in the living room,” he said. “There’s no checkpoints once you’re in there.”

In addition, internet security at Trump properties, including Mar-a-Lago, has been described by ProPublica and Gizmodo as “not good.” Reporters said they could have hacked into three weakly encrypted networks at Mar-a-Lago in May 2017, but decided not to. One digital security expert said Trump’s networks “have to be crawling with foreign intruders.”

Says Otis, “This administration is just one giant gift to foreign intelligence services.”

As she wrote in an October op-ed for USA Today, Trump reportedly uses unsecured personal cell phones, against the advice of his aides, in order to avoid going through the White House switchboard. The Chinese have allegedly already obtained information from these calls, “to influence and manage the trade war with America,” Otis wrote, citing an investigation by The New York Times.

The information US adversaries are seeking doesn’t necessarily have to be classified or top-secret, either. According to Otis, learning about things such as personnel issues, internal strife among high-level officials, and lack of coordination between government agencies “makes it easier for foreign governments to play federal agencies off one another to gain the advantage.”

Read the full text of the criminal complaint against Yujing Zhang here: