Frances Robles

The words that appear are verbs like “fired,” “axed” and “sacked.”

The former information technology director of Lake City, the northern Florida city that was forced to pay out nearly half a million dollars after a ransomware attack this summer, was blamed for the breach, and for the long time it took to recover. But in a new lawsuit, Hawkins said he had warned the city about its vulnerability long ago — urging the purchase of an expensive, cloud-based backup system that might have averted the need to pay a ransom.

But there was no money. And to those weighing the many competing priorities in the northern Florida city of 12,000 people, purchasing capacity on remote computer servers didn’t seem to rise to the top — at the time. Once the city’s entire computer network crumbled in the space of a few hours, there was an intense round of finger-pointing, and it ended with Hawkins.

“My name has been blasted all over the media and across the country for weeks,” he said in his first interview with the news media since the attack this summer.

The recent cyberattack in Texas, which crippled the computer systems of nearly two dozen cities simultaneously, has served as another reminder of how outgunned most municipalities are against sophisticated hackers. With cities from Florida to Maryland grappling with an onslaught of ransomware attacks that are costing millions, the harsh reality is that it is often one- or two-person information technology offices with meager budgets and strict spending rules that are the main lines of defense.

They are often up against organized criminals and nation-state actors who know how to take advantage of their weaknesses, and who are able to refine their weapons with the hundreds of thousands of dollars in ransoms being paid by vulnerable cities.

The lawsuit Hawkins filed in Columbia County state court Aug. 9 raises the inevitable question of liability: When hackers wipe out a city’s computer system, who is to blame?

“There is a push for accountability, which means firing people. It almost never happens,” said James Lewis, a researcher at the Center for Strategic and International Studies. “A lot of times ransomware exploits a vulnerability that should have been fixed. You need to look: Did somebody slip up on the job?”

Two high-level IT employees were fired after an attack this year in Baltimore, but city officials denied that the dismissals were related, The Baltimore Sun reported. No one in the Texas city of Laredo was disciplined after an attack there. A spokesman for the Texas Department of Information Resources declined to comment, citing the pending investigation.

The troubles in Lake City, about an hour west of Jacksonville, began when several city employees reported that they had fallen for a phishing attack.

Employees at the city clerk’s office, water plant and airport had clicked on an email purportedly from one of their contacts that said something like, “you have an invoice ready.” It was personalized and looked legitimate, but it was really a spear-phishing attack, using what is known as Ryuk “triple threat” ransomware.

One of the emails was cleverly disguised: It even made reference to a prior conversation the city employee had had via email, Hawkins recalled. The email had bypassed spam filters and anti-virus software, which Hawkins said were both up-to-date.

“They were super crafty,” Hawkins said.

Hawkins took the city’s network offline, re-imaged the computers and took other normal precautions. But deep down, he knew that trouble could be looming if anyone else had clicked on the suspicious email without reporting it. The next sign of trouble emerged a few weeks later, on a weekend in early June, when the email system began running slowly.

Nobody works on the weekends at City Hall. So Hawkins waited until Monday morning to tackle the problem, but by then, it was too late. All of the city’s files were encrypted, and a note had been left on the city’s servers that read: “How do you want to open this type of file? Balance of shadow universe.”

Phones were down, email was out of commission, computers did not work, and even the photocopiers were inoperable.

The hackers who had left the note subsequently asked for exorbitant sums of money to release the city’s data.

Even after the city’s insurer paid 42 bitcoins — about $460,000 — for the key to decrypt the files, it took weeks for the city to recover. Some files appear to be still missing, and presumably are lost, said Joseph Helfenberger, the city manager.

Hawkins got a formal letter from Helfenberger on June 21.

“Recent events, including a cyberattack on the City of Lake City and the inability to quickly recover from this attack, including the failure to have in place a reliable and effective backup system,” it said, “have demonstrated significant weaknesses with the city’s IT department under your leadership.”

Hawkins said that the city could have been able to recover quickly from the attack had it agreed to purchase the off-site, cloud-based backups he had recommended in 2017. City officials balked at the price and went for backups located on the same server, which the hackers sabotaged, he said.

The city did pay for a cloud-based backup for the applications used to run day-to-day business, which was why the city was able to continue offering services.

“It was pretty tough, especially after working so hard toward recovery,” Hawkins said. “Yes, we were affected, yes, we were crippled, but we were still serving the citizens of Lake City the very next day.”

Hawkins filed a public records request for his own hard drive and emails that would prove that he had suggested the extended cloud purchase. His lawsuit this month seeks a court order to disclose the material.

After the lawsuit was filed, the city responded, but said it would be charging about $7,000 to review and redact the records, said Adam Morrison, Hawkins’ lawyer, who said he was also considering filing a defamation lawsuit.

Helfenberger, the city manager, said that because of the lawsuit he was limited in how much he could say on the matter.

“Brian Hawkins might have talked to somebody in 2017 about the need for some improvements, but I did not start working here until August 2018,” Helfenberger said. “I don’t know if he would have put in all the measures we are putting in right now. There are other issues besides this. This was not the only reason he was terminated.”

Hawkins got another job at WatchPoint Data, a firm that has created a tool that helps fight ransomware attacks.

“As soon as I saw the stories breaking that he had been fired, I immediately thought: scapegoat,” said Greg Edwards, WatchPoint’s chief executive. “He was doing the things he knew to do.”

Roy Hadley, Jr., a lawyer who leads the municipal cyber practice for a Georgia firm that represents the city of Atlanta, which was hit by ransomware last year, said incidents like the one in Lake City underscored what cities may come up against: sophisticated hackers, some of whom may have foreign-government backing, whose only job is to launch cyberattacks.

While no government has been accused in the most recent round of municipal cyberattacks, federal authorities identified the digital fingerprints of the Russian military intelligence agency in an intrusion of at least two county election systems in Florida in 2016.

North Korea was accused by several governments of directing the WannaCry ransomware attack that struck computers in 150 countries in 2017.

In the attack on Atlanta, which so far has cost the city about $8.5 million, two Iranian nationals were indicted in December on charges of computer fraud.

“People just need to realize it is a national problem. It is a national problem, and it needs a national response,” Hadley said. “A lot of smaller communities are resource-constrained. If you have $1 million, are you going to fix the potholes constituents have been calling about, open parks and swimming pools for the summer? Or buy new servers and do all the things that are going to make you more secure?”

This article originally appeared in <a href="https://www.nytimes.com/2019/08/22/us/florida-ransomware-hacking-it.html" id="0472efd3-ccb9-3216-a509-e0c0464e943c">The New York Times</a>.

When Ransomware Cripples a City, Who's to Blame? This IT Chief Is Fighting Back

Brian Hawkins Googles his name and last employer and winces.

It was addressed to Wanda Vázquez, who is set to step into the job later this week.

Some of the protesters who successfully ousted Gov. Ricardo Rosselló after two weeks of rallies appear now to have set their sights on Vázquez, the secretary of justice, who under the territory’s constitution will become governor when Rosselló’s resignation becomes effective at 5 p.m. Friday.

Several hundred people banged on pots and pans while marching in front of her office Monday, demanding that she not only decline to take the governor’s post, but also resign from her current job as well.

“She has acted more like Rosselló’s lawyer than a justice secretary,” said Marta Quiles Jiménez, 33, a San Juan psychologist who was among the protesters.

The latest signs of opposition to Vázquez, who is seen as too close to cover-ups and corruption in Rosselló’s unpopular administration, present a test for the new revolutionary movement that unseated the current governor: Can the loosely organized street protests that mobilized hundreds of thousands of people to oust Rosselló be channeled into longer-term change in Puerto Rico?

Protesters ran Rosselló out of office last week after the release of a series of offensive text messages tapped into long-standing public frustration over corruption, economic problems and a slow response to Hurricane Maria in 2017.

Emboldened by their victory, some of the leaders of the demonstrations are making it clear that their demands went beyond simply ending the governor’s term a year and a half early. They are insisting on fundamental democratic changes in a place where two-party politics traditionally have played out within a relatively limited circle of power. Fears that party leaders are negotiating secret deals to name a crony as the governor’s replacement — or that Vázquez could in fact end up as governor — have already led to the threat of ongoing protests.

“It’s like they haven’t learned a thing,” said Melissa Mark-Viverito, a former New York City Council speaker whom the governor insulted in the chats and who has been participating in the protests. “For them to be striking backroom deals to pick a new governor is everything that the people found repugnant and everything that has the people marching again. You cannot replace one corrupt administration with another corrupt administration.”

Rosselló was forced out after two weeks of immense pressure both on the streets and within his party. The secretary of state, who would normally take the governor’s place, had already resigned over his own role in the bawdy text exchange. That means Vázquez is next in line — unless the ruling New Progressive Party can name and confirm a new secretary of state by Friday.

Party leaders have encouraged the governor to name someone quickly, but no acceptable candidates have emerged.

On Friday, the governor posted photos of himself and Vázquez together planning the “transition.”

But on Sunday, she posted on Twitter that she does not really want the job. “I reiterate, I have no interest in occupying the governor’s post,” she wrote. “It is a constitutional rule. I hope the governor identifies and submits a candidate for the position of secretary of state before Aug. 2, and I have told him so.”

Some news outlets took that to mean that Vázquez was turning down the job. A spokeswoman for her office, Mariana Cobián, clarified Monday that the justice secretary was simply saying that she has never been an elected politician, and does not seek to become one.

“She is a believer and follower of the law and the constitution,” Cobián told The New York Times. “It is what the constitution says, and she will do what the constitution says.”

In recent days, Vázquez has come under fire because she had declined to investigate trailers loaded with unused hurricane aid that were found a year after Maria. Leaked messages showed that she had not only passed on looking into the matter, but also had discussed the issue with the governor’s chief of staff before doing so.

Vázquez, a former prosecutor, had also been the head of the island’s women’s affairs office. The occupant of that position, a 10-year appointment, is supposed to serve as an advocate for women’s issues. Vázquez was the subject of controversy from the start, after suggesting that domestic violence victims should take up arms against their abusers. But feminist groups said that when it came to new policies to help women, she failed to act.

The feminist groups had pushed for the administration to declare a state of emergency after a spike in gender-based violence, but Vázquez, they complained, did not take a position on the matter. She left the position after seven years to become secretary of justice.

Vázquez was briefly suspended as Puerto Rico’s justice secretary last year after she was accused of meddling in a case in which her daughter was the victim of a burglary. A judge cleared her and she returned to her post.

Opposition to Vázquez began building even before Rosselló announced his resignation on Wednesday. The hashtag #WandaRenuncia (“Wanda Resign”) has been shared on Twitter 62,129 times in the past week.

“Instead of being a person who opens a path to justice, she puts up obstacles to favor her party,” said Yaddeliz Martínez, an activist who created a Facebook invite to promote Monday’s demonstration against Vázquez. “If we manage to take down someone who is corrupt, we cannot allow a person who is the same to replace him.

René Pérez, the rapper known as Residente, canceled engagements in New York to continue to protest even after Rosselló announced his resignation. “Even if he resigns, the next person in line to be governor is going to be corrupt, so that’s why we have to stay on the streets fighting the same way we fought,” Pérez said in a voicemail message to The Times. “I think we need new faces.”

He noted that the succession rules are enshrined in a constitution that was written not by Puerto Ricans, but rather by officials in Washington decades ago.

Yadira Carrasquillo González, a 45-year-old activist who joined the protest outside Vázquez’s office, said many of those who are still in the streets are hoping to change the status quo in favor of a community-based system in which candidates are chosen not by party leaders, but by the public.

“We want them all to resign,” Carrasquillo said. “My God, yes, let them all go. They are all part of the system of corruption. We don’t want any of them.”

If Vázquez were to decide not to accept the position, the job would fall to the secretary of education, Eligio Hernández, who is fifth in line and has been in his job only since April. The person who is fourth in line, the treasury secretary, would be passed over because the Constitution dictates that the governor has to be at least 35 years old.

The treasury secretary, Francisco Parés, is only 31.

“The people don’t trust anyone who is tied to this Cabinet,” said Alvin R. Couto de Jesús, a lawyer and activist who helped to organize Monday’s march. “Nobody tied to this administration can take that seat. Nobody who has been tainted by corruption should become the next governor.”

This article originally appeared in <a href="https://www.nytimes.com/2019/07/29/us/puerto-rico-march-vazquez-rossello.html" id="81fd707b-1e01-3811-aad0-603f5ccb5dd7">The New York Times</a>.

Next in Line as Puerto Rico's Governor Is Also Next in Line as Target of Protests

SAN JUAN, Puerto Rico — The message from the public to the woman who is in line to become Puerto Rico’s next governor has been as clear — and as literal — as the writing on the wall: “We are coming for you,” read a patch of graffiti on a building in Old San Juan.

The pop superstar Ricky Martin, the rapper Residente, his sister iLe, and the Latin trap artist Bad Bunny combined their efforts in support of a social movement like no other Puerto Rico has ever seen. Bad Bunny, whose legal name is Benito Antonio Martínez Ocasio, even cut off a tour to fly to San Juan. They joined singers La India and Danny Rivera and actor Benicio Del Toro, who were present at a protest Wednesday night that filled the streets from the Capitol to the governor’s mansion a mile away.

Martin announced his participation in a video on Twitter that he shared with his 20 million followers.

“Frustrated. Angry. I feel this horrible pressure in my chest,” he said. “How do I free myself of this anguish? Simply traveling to Puerto Rico.”

Residente, iLe and Bad Bunny produced a protest song — written and recorded in one day — called “Afilando los Cuchillos” (Sharpening the Knives) that had 2.5 million views on YouTube within a day of its release.

Playwright Lin-Manuel Miranda joined the protest in New York.

Experts say the involvement of artists from so many different genres of music, from pop to reggaeton to Latin trap, could draw a range of young people who are usually turned off by traditional party politics. And it likely tightened the pressure on the governor, who is increasingly isolated with few public supporters.

“This is really important, not just because we or the other artists arrived, but because this is historic,” René Pérez Joglar, who uses the stage name Residente, said in an interview. “When we unite, this becomes an international story,” he said. “But understand that people are there because they are upset, not because they want to see artists.”

Rosselló is under pressure to leave office after the release of nearly 900 pages of chat messages among him and his inner circle, including the island’s chief financial officer and secretary of state, in which the governor called a former New York City Council speaker a whore and joked about shooting San Juan’s mayor, Carmen Yulín Cruz. The chat scandal came on the heels of corruption arrests of two top former officials in his administration.

The chat was the breaking point for an island of more than 3 million people that had already endured a devastating hurricane, job losses and, in some areas, no electricity for nearly a year.

“People still don’t have roofs on their houses,” Pérez said. “I think there are a lot of things happening at the same time. There is a new generation of young people that has a different mindset. This generation is very aware. That is fundamental.”

Pérez’s presence at the protest is hardly a surprise: He has always been vocal about his desire to see Puerto Rico become an independent nation. But for Puerto Ricans to see Martin and Bad Bunny protesting was a game-changer for the island, said Yarimar Bonilla, a political anthropologist at Hunter College.

“Ricky Martin is not known for political stances. He’s a Buddhist; he is peaceful. For him to get involved, that is important and says something,” she said. “Bad Bunny’s presence was so important: He has a rising political influence and has a much younger depoliticized following.”

Martin’s homosexuality was mocked in one of the posts by another official in the governor’s chat group. “Nothing says patriarchal oppression like Ricky Martin,” it said, going on to describe him using crude language as a “male chauvinist” for whom “women don’t measure up. Pure patriarchy.”

Young people who may not have been raised on politics now have an entry into the protest movement, Bonilla said, noting that people were using lyrics from recent popular songs and turning them into protest slogans. A song about dumping a girlfriend became a chant about canning the governor.

Bonilla, who attended the protest, said she was struck by the fact that the musicians were not performing, but standing on a platform waving flags.

“It wasn’t a concert,” said Ileana Mercedes Cabra Joglar, Pérez’s sister, who uses the name iLe when performing. (She did sing a revolutionary hymn.)

Cabra sings the chorus in “Afilando los Cuchillos.”

It offers a sharp-edged rebuke to Rosselló, accusing him of inheriting a legacy from his father, a former Puerto Rico governor whose administration was wracked by corruption, and it delivers a jab to the first lady, Beatriz Rosselló, noting a gaffe she once made that suggested a lack of knowledge of Spanish-language literature.

“Normally the same people go to protests all the time,” Cabra said. “This transcended everything. This feels like a big family.”

Bianca Passalacqua, 21, a recent graduate of the University of Puerto Rico, said the singers were a draw — but to different key audiences.

“I believe it’s important that they come, because of the convening power they have,” Passalacqua said. “The fact that they come does make more people want to participate. For example, Bad Bunny attracts more millennials, while Ricky Martin attracts the elderly.”

“In my case,” she added, “I would have participated anyway.”

This article originally appeared in <a href="https://www.nytimes.com/2019/07/19/us/puerto-rico-residente-ile-afilando-los-cuchillos.html" id="9fa4a27b-e55c-304b-ac0f-be94b67e07f2">The New York Times</a>.

'Sharpening the Knives': Musicians Join the Protests in Puerto Rico

Among the tens of thousands who flocked to the streets of Puerto Rico this week to call for the resignation of the island’s governor, Ricardo A. Rosselló, there was a new kind of activist: well-known musicians ready to use the clout of their enormous social media followings to energize the brewing discontent.

Lisa Lewis, the supervisor of elections, stumbled on an important email sent to her and three others in the office, by then a week old, that appeared to be from VR Systems, the vendor that sells electronic voter list equipment to nearly every county in the state. “Please take a look at the instructions for our modernised products,” it said, using British spelling and offering an attachment. Something about the email seemed off.

“It was from Gmail,” Lewis said. “They don’t have Gmail.”

Lewis, it turned out, was right to be suspicious. Though it had VR Systems’ distinctive logo, with a red V and a blue R, the email contained a malicious Trojan virus, and it originated not from the elections vendor but from the Russian military intelligence unit known as the GRU. The email had been sent to 120 elections email accounts across Florida.

Also buried in Lewis’ inbox was a warning from VR’s chief operating officer, flagging the dangerous spearphishing attempt and warning all his customers not to click on it.

Slipped into the long-anticipated special counsel report on Russian interference in the 2016 election last week was a single sentence that caused a stir throughout the state and raised new questions about the vulnerability of the nation’s electoral systems.

Although the spearphishing attempt in Florida had first been brought to light nearly two years ago when The Intercept cited a secret National Security Agency report, state officials said they were certain no elections computers had been compromised. The Mueller report turned that assertion on its head. “The FBI,” it said, “believes that this operation enabled the GRU to gain access to the network of at least one Florida county government.”

The report has sent Florida officials scurrying once again for specifics. Which county? Could there have been more than one?

“They won’t tell us which county it was. Are you kidding me?” an exasperated Ron DeSantis, Florida’s Republican governor, said at a news conference in Miami on Thursday. “Why would you have not said something immediately?”

The Florida Secretary of State’s office in Tallahassee said it had been unable to learn which county it was. “The department reached out to the FBI and they declined to share that information with us,” said Sarah Revell, a department spokeswoman. “No county has come forward.” The secretary of state who was running the department at the time, Ken Detzner, did not respond to requests for comment.

DeSantis, who took office in January, is scheduled to meet with the FBI in the coming weeks, and has promised to make the information public, if it is not classified.

VR Systems’ chief executive, Ben Martin, said his company was aware of only a “small number of customers” who had received the fraudulent email, and of those, none had notified VR Systems that they had clicked on the attachment or were compromised.

In an interview Friday, Sen. Marco Rubio, R-Fla., said there was, in fact, an intrusion, but the target or targets were never notified. The information was gleaned through an intelligence operation, not a criminal investigation, said Rubio, a member of the Senate Intelligence Committee. To protect intelligence methods, he said, national security officials chose to issue a general warning to everyone.

“Everybody has been told what it is they need to do to protect themselves from the intrusion,” Rubio said. “I don’t believe the specific victims of the intrusion have been notified. The concern was that in a number of counties across the country, there are a couple of people with the attitude of: ‘We’ve got this; we don’t need your help. We don’t think we need to do what you are telling us we need to do.’”

Rubio said he was constrained as a member of the Intelligence Committee as to how much he could tell his constituents.

“When someone you know had a problem, but you can’t tell them they had a problem, it becomes tense,” he said.

The hackers, he added, were “in a position” to change voter roll data, but it does not appear they ever acted on it.

Such an intrusion could have been devastating, he said. “My biggest concern is that on Election Day you go vote and have mass confusion because voter registration information has been deleted from the systems.”

Rubio and Florida’s former Democratic senator, Bill Nelson, wrote a letter last year to the state’s top elections official encouraging him “in the strongest terms” to take advantage of federal services to secure election systems.

“I have repeatedly voiced concerns about overconfidence of some #Florida elections officials,” Rubio said on Twitter this week.

Nelson, who lost his bid for re-election and left office at the end of 2018, said he could not share classified information on the purported intrusion.

“The Senate Intelligence Committee Chairman and Vice Chairman asked Senator Rubio and me in June 2018 to send a letter to the 67 county Supervisors of Election to warn them of Russian intrusion in Florida,” Nelson said in a statement. “The Mueller Report makes clear why we had to take that important step as well as my verbal warnings thereafter.”

At the time, Nelson’s warnings did not appear to be taken seriously, and in fact were widely criticized.

“When Bill Nelson said that, Republicans ripped him apart,” said Ion Sancho, the longtime supervisor of elections in Tallahassee, who recently retired. “‘You senile old man!’ Guess what, he might have been right.”

The FBI did hold a conference call warning all Florida elections supervisors of a cyber threat two months before the 2016 election, but officials declined to say this week whether the bureau ever told elections supervisors from the county that had been hacked about the breach.

An official with the Department of Homeland Security, who spoke on the condition of anonymity because of the sensitivity of the matter, said that whenever the authorities discover a successful case of hacking, targets are notified by the FBI. Identities are kept secret in an effort to maintain positive working relationships with hacking victims.

“We believe it is their purview to talk about the possible incident, how it impacted them and when,” the official said.

The official stressed that elections computer systems in 48 of 50 states are now equipped with “Albert sensors,” devices affixed to networks to detect cyber intrusions. No foreign government has been found to be trying to penetrate, the official said, and the process of hardening security has vastly improved information-sharing between county, state and federal agencies.

Paul Lux, president of the Florida State Association of Supervisors of Elections, said elections supervisors across the state still have not been made aware of exactly what happened.

Most said they had received no specific reports. “I have not heard a whisper of such a thing,” said Lux, who runs elections in Okaloosa County, in northwest Florida. But he isn’t necessarily surprised. “If you had a neighbor’s house broken into, the police aren’t going to knock and say, ‘Hey, just to let you know, Fred down the street got broken into, so be careful.’”

He and other elections officials parsed the language in the Mueller report, wondering whether the semantics offered hints. “We understand the FBI believes that this operation enabled the GRU to gain access to the network of at least one Florida county government,” the report said.

“Accessing can be like sneaking into an apartment building behind someone, but you can’t get the code for the elevator, so you are stuck in the lobby and get bored and leave,” Lux said.

Elections officials throughout the state insisted that even if systems were penetrated, it likely would have been the voter registration rolls, where a hacker could potentially wreak havoc on Election Day by changing addresses and precincts — but would not be able to gain access to vote tabulations.

“They’d have to knock me out, steal the key and passcodes — in front of multiple cameras,” said Todd Putnam, the systems administrator for Lee County Supervisor of Elections, near Fort Myers.

In the end, it appeared that most counties successfully fended off the attack. In response to a public record request from a reporter, officials in Broward County, who had initially denied they had been the target of any spearphishing attempt, reported that at least three people there had been targeted with the fake VR email. It had been blocked by spam filters, they said.

“Did we get hacked? No. We did get phished,” said Steve Vancore, a spokesman for the Broward elections office. “A rock was thrown at the window, the window didn’t break. The rock bounced off.”

This article originally appeared in <a href="https://www.nytimes.com/2019/04/26/us/florida-russia-hacking-election.html" id="810995ce-d5e2-325e-ac55-90e7d48a6bac">The New York Times</a>.

Russian Hackers Gained Access to at Least One Florida Elections Network. But Which One?

It was the day before the 2016 presidential election, and at the Volusia County elections office, near Florida’s Space Coast, workers were so busy that they had fallen behind on their correspondence.

Lisa Lewis, the deputy supervisor, stumbled on an important email sent to her and three others in the office, by then a week old, that appeared to be from VR Systems, the vendor that sells electronic voter list equipment to nearly every county in the state. “Please take a look at the instructions for our modernised products,” it said, using British spelling and offering an attachment. Something about the email seemed off.

The disclosure raised new questions about the intentions of the woman, Yujing Zhang, 33, who told authorities she had come to attend a United Nations Chinese Friendship Association event associated with a gala that night. Instant messages recovered from one of her cellphones revealed that Zhang had been told even before she left Shanghai that the Mar-a-Lago event had been canceled, Rolando Garcia, an assistant United States attorney, told the court.

Zhang had texted back, Garcia said, “wanting to know why the event was canceled.”

Magistrate Judge William Matthewman of the U.S. District Court in West Palm Beach rejected Zhang’s bid to be released on bail, concluding that there was a substantial risk she could flee the country if released before her trial on charges of entering restricted property and making false statements to a federal agent.

“It does appear to the court that Ms. Zhang was up to something nefarious,” the judge said.

But prosecutors also revealed that they were no longer certain that a thumb drive Zhang was carrying when she entered the resort on March 30 was infected with “malicious malware,” as they had earlier claimed.

At a hearing last week, a Secret Service agent testified that when Zhang’s thumb drive was inserted into an agency computer, it immediately began to install files on the computer. The analysis was quickly halted to “stop the corruption,” the agent, Samuel Ivanovich, told the court.

But Garcia said Monday that when the agency conducted a deeper analysis of the thumb drive, the device did not repeat what had happened the first time, “which suggests that it could have been a false positive” for the presence of malware.

Defense lawyers said that Zhang, a Chinese citizen with a degree from Shanghai University, never tried to deceive Secret Service agents and was admitted to the members-only club on a weekend when Trump and his family were in residence after the club management determined that her surname — one of the most common in China — matched that of a Mar-a-Lago member.

“The sad fact is that if a Mandarin interpreter had been provided at that first Secret Service checkpoint, we very well would not be here today,” said Kristy Militello, one of Zhang’s federal public defenders.

Matthewman said his decision to deny bail was based in part on the sheer variety of electronics Zhang carried with her, including a laptop, an external hard drive and four cellphones. A sweep of Zhang’s room at the Colony Hotel near the resort turned up a device used to detect hidden cameras, nine jump drives and five SIM cards, authorities said, along with 75 $100 bills.

“The added fact that she was 1 to 2 feet, arm’s length, of a computer at Mar-a-Lago is also extremely concerning,” Matthewman said. “The nature of the crimes and the charges are very serious and very troubling.”

Federal prosecutors have emphasized that Zhang is not being charged with espionage.

The false statement charge contained in a grand jury indictment returned Friday also concerns Zhang’s statement to a federal agent that she had come to use the pool, though she had no swimsuit with her.

Zhang, who owns a home and a BMW back in China, had paid for a vacation package that included a banquet at Mar-a-Lago. But the gala she had paid to attend had been canceled when news outlets revealed that the Florida woman who had a role in promoting the event had once owned a massage parlor where the owner of the New England Patriots, Robert Kraft, was charged with paying for sex acts.

The former owner, Cindy Yang, had sold the parlor and become active in Republican circles in Florida. She bundled donations for Trump, including some that had the appearance of being illegal donations by straw donors. The event she had been selling tickets to was canceled in the wake of the scandal.

Zhang lowered her head and glanced at papers in front of her when she heard the news that she was going to be held in jail.

Her lawyers did not stop to speak to reporters after the hearing and did not respond to prosecutors’ assertion that Zhang had known the event she planned to attend had been canceled.

Last week, though, they emphasized that there was little evidence to support the charges in the indictment.

“In order to gain entry, the only thing Ms. Zhang did was give a very common Chinese name and make no claims she was there as a member or family member,” her lawyer, Robert E. Adler said. “I don’t understand how this would support a trespassing charge after making no misrepresentations.”

Matthewman said that if Zhang were convicted of lying to a federal agent, she would face a maximum sentence of five years in prison and a $250,000 fine.

This article originally appeared in <a href="https://www.nytimes.com/2019/04/15/us/zhang-mar-a-lago.html" id="e41fa824-533a-361f-ab82-01dda454f6c1">The New York Times</a>.

Mar-a-Lago Suspect Is Deemed a Flight Risk and Denied Bail

WEST PALM BEACH, Fla. — The international finance consultant accused of illegally entering President Donald Trump’s Mar-a-Lago resort in Florida knew several days before she traveled to the United States that the gala she had paid to attend had been canceled, federal prosecutors said Monday.

Zhang, 33, is scheduled to face a federal judge Monday afternoon for the third time since she was arrested on March 30 inside President Donald Trump’s gilded waterfront resort. The authorities said she had gained entry on the strength of a dubious party invitation and was carrying a laptop computer, four cellphones and a thumb drive infected with malware in her purse. The judge will consider her request to be released on bail.

The long gray dress she wore to the club has been replaced with the navy blue scrubs worn by female federal inmates, and her cell doubtless bears little resemblance to the $600-a-night boutique hotel where she had been staying in Palm Beach. Zhang had paid $20,000 and flown 8,000 miles from Shanghai, but her luxury business trip was over after just two days in Florida.

Zhang, a Chinese citizen, was indicted on Friday on charges of lying to a federal agent when she said she was at Mar-a-Lago to use the pool; she had no swimsuit with her. She is also accused of illegally entering a restricted area, even though club employees had escorted her in because her surname — one of the most common in China — was the same as that of a dues-paying member.

Prosecutors said that a sweep of Zhang’s room at the Colony Hotel near the resort turned up a device used to detect hidden cameras, nine jump drives and five SIM cards. She also had about $8,000 in cash.

A federal prosecutor, Rolando Garcia, urged the judge in the case last week to keep Zhang locked up because so much about her was still a mystery, including what level of bail would assure her appearance at trial. “To say that there is incomplete information of her financial assets is an understatement,” Garcia said.

He said the authorities were furiously examining her electronic devices, and that what was known from them so far did not back up her claim that she had gone to Mar-a-Lago for a United Nations Chinese Friendship Association event. No such event appeared on the club calendar, although a related event had been scheduled and then canceled.

Garcia stressed that while Zhang has not been charged with espionage, her intentions were still murky, he said, and she “lies to everyone that she encounters.”

If the judge in the case, Magistrate Judge William Matthewman, decides to release Zhang pending trial, she would probably be immediately detained by immigration authorities. She no longer has a legal basis to remain in the country because the State Department has revoked her tourist visa.

Zhang’s federal public defender, Robert E. Adler, said he planned to present witnesses on her behalf to tell the court on Monday that they were willing to provide Zhang with a place to stay while her case winds through the courts. Adler’s strategy was complicated by the loss of Zhang’s visa, he said, so to obtain her freedom, he may have to argue the matter twice, first to Matthewman and then to an immigration judge.

“In order to gain entry, the only thing Ms. Zhang did was give a very common Chinese name and make no claims she was there as a member or family member,” Adler said. “I don’t understand how this would support a trespassing charge after making no misrepresentations.”

He said the whole episode was either a misunderstanding or a mistake by the Mar-a-Lago staff.

Matthewman said that if Zhang is convicted of lying to a federal agent, she faces a maximum sentence of five years in prison and a $250,000 fine.

Will Chinese Businesswoman Arrested at Mar-a-Lago Get Out of Jail?

WEST PALM BEACH, Fla. — Yujing Zhang managed to talk her way into Mar-a-Lago. Can she manage to get out of jail?

Yujing Zhang, 33, told authorities she had come to the South Florida resort at the invitation of a Chinese group that was advertising opportunities to attend social events and rub elbows with political celebrities — a business campaign that has raised questions about security at the exclusive private resort where Trump and his family are often in residence.

The trove of curious electronics Zhang was caught with — including a thumb drive infected with malware, four cellphones and, back at her hotel, a signal detector used to find hidden cameras — prompted suspicions, authorities said.

The grand jury indictment handed down Friday did not add any espionage charges, but instead contained one count of lying to a federal agent, which carries a maximum five-year prison sentence, and one of accessing a restricted area, punishable by a year in prison.

When she arrived shortly after noon on March 30, Zhang initially said she wanted to use the swimming pool, federal prosecutors said. Her surname matched that of a member of the club, so security officers escorted her in.

But once she was inside the club and was questioned more closely, prosecutors said, Zhang changed her story. She said she was there for a “United Nations Chinese Friendship Association” event, which did not appear on the club’s calendar.

Secret Service agents detained her, and at that point discovered the electronics gear she was carrying. She was charged with lying to federal agents as a result of her earlier statement about wanting to use the swimming pool — a search revealed that she had no swimsuit in her bag.

Prosecutor Rolando Garcia told the court that the electronics and $8,000 in cash in Zhang’s hotel room suggested that she had come to Palm Beach for more than a party.

A search of her hotel room a few miles away from Mar-a-Lago uncovered a device that detects hidden cameras, as well as nine jump drives and five SIM cards, Garcia said.

This article originally appeared in <a href="https://www.nytimes.com/2019/04/12/us/chinese-zhang-mar-a-lago.html" id="f1581dfc-dc34-3d48-a21c-baf61cfc73ef">The New York Times</a>.

MIAMI — A businesswoman from China who was arrested last month at President Donald Trump’s Mar-a-Lago resort in Florida when she showed up with a bag full of questionable electronics gear was indicted Friday after a federal grand jury found there was sufficient evidence to hold her for trial.

Grand Jury Indicts Chinese Woman on Charges of Lying and Trespass at Mar-a-Lago

The woman, Yujing Zhang, who was born in 1986, was arrested March 30 after telling Secret Service agents that she had come to use the pool at Mar-a-Lago and showing two Chinese passports. After authorities determined that the event she said she had come to attend did not exist, she was arrested and charged with lying to a federal officer and accessing a restricted area.

Zhang had entered the property with four cellphones, a hard drive and a thumb drive infected with malware, according to federal court records. Upon searching her hotel room, investigators found another cellphone and a radio frequency device that detects hidden cameras, Assistant U.S. Attorney Rolando Garcia said during a bond hearing at the U.S. District Court in West Palm Beach on Monday.

She also had nine USB drives and five SIM cards in her room at the Colony Hotel, along with several debit cards and about $8,000 in cash, including about $700 in Chinese currency, Garcia said.

Garcia told U.S. Magistrate Judge William Matthewman that Zhang is a “serious flight risk” because she “lies to everyone that she encounters.”

She had initially told authorities at the club that she carried multiple phones to the resort because she was afraid to leave them in her hotel room, Garcia said. She had previously told the court in an appearance last week that she had only about $5,000 in the bank.

“Someone who is afraid of her property being stolen at the hotel does not leave so much cash and credit cards in a hotel room,” Garcia said.

Zhang came to the United States on March 28 from Shanghai on a B-1 visa that has been revoked, meaning that if the court does release her from jail pending trial, she would be transferred to immigration custody, Garcia said.

“She has really no ties to the Southern District of Florida, or the United States of America, for that matter,” he said.

Zhang’s assistant federal public defender, Robert Adler, said in the court hearing that Zhang did not attempt to hide the four cellphones when she entered the club. He stressed to the judge that she is not charged with espionage.

“We have heard the government has no reason to believe Ms. Zhang was a spy,” Adler said.

The Secret Service agent who questioned Zhang after her arrest, Samuel Ivanovich, said during testimony that she did not carry any lock-picking or eavesdropping gear. His 4 1/2-hour interrogation of Zhang was recorded by video, Ivanovich said, but it lacked sound because he didn’t realize that the agency’s office in Palm Beach didn’t have that capability.

Ivanovich testified that the computer analyst who reviewed Zhang’s devices said the thumb drive she was carrying had immediately begun installing a program on his computer.

“He stated that he had to immediately stop the analysis and shut off his computer to halt the corruption,” Ivanovich said.

Adler said there was nothing to suggest that Zhang was a spy, but prosecutors said that was irrelevant to the question of whether she should be let out on bond, because that’s not what she was charged with.

“What did she actually do?” Adler said. “What she did was the equivalent of saying, ‘My name is Smith, I’d like to use the pool.’ ”

The judge postponed a decision on whether to release her on bond until next week, to give the defense time to bring people from China who could support Zhang’s story.

This article originally appeared in <a href="https://www.nytimes.com/2019/04/08/us/mar-a-lago-arrest.html" id="9d22368f-835a-34d9-a672-6f0991d3d143">The New York Times</a>.

WEST PALM BEACH, Fla. — The Chinese woman who was arrested after gaining entry to President Donald Trump’s private club while carrying four cellphones and other electronic equipment had even more electronics in her hotel room, including a device used to detect hidden cameras, a federal prosecutor said Monday.

Chinese Woman Arrested at Mar-a-Lago Had Hidden Camera Detector, Prosecutors Say

It falls to Sikes, as official custodian of records for this city of 12,000 people about an hour west of Jacksonville, to maintain Lake City’s archives. She keeps a log of public record requests and has spreadsheets that track things like property deeds and building permits. She spent years digitizing all the papers of a city that incorporated before the Civil War.

“It’s everything I do,” Sikes said.

Frances Robles

Articles written by the author

When Ransomware Cripples a City, Who's to Blame? This IT Chief Is Fighting Back

Next in Line as Puerto Rico's Governor Is Also Next in Line as Target of Protests

'Sharpening the Knives': Musicians Join the Protests in Puerto Rico

Russian Hackers Gained Access to at Least One Florida Elections Network. But Which One?

Russian Hackers Gained Access to at Least One Florida Elections Network. But Which One?

Mar-a-Lago Suspect Is Deemed a Flight Risk and Denied Bail

Will Chinese Businesswoman Arrested at Mar-a-Lago Get Out of Jail?

Grand Jury Indicts Chinese Woman on Charges of Lying and Trespass at Mar-a-Lago

Chinese Woman Arrested at Mar-a-Lago Had Hidden Camera Detector, Prosecutors Say

They paid nearly a half million in ransom. Where's the data?

Russian hackers gained access to at least one Florida elections network. But which one?

Mar-a-Lago suspect is deemed a flight risk and denied bail

Grand jury indicts Chinese woman on charges of lying and trespass at mar-a-lago

Chinese woman arrested at Mar-a-Lago had hidden camera detector, prosecutors say

Woman from China arrested after entering Mar-a-Lago with malware