Paul Le Roux

Background

Paul Calder Le Roux was born on December 24, 1972, in Bulawayo, in what was then Rhodesia (present-day Zimbabwe). He held citizenship in Zimbabwe and South Africa and later became a naturalized citizen of Australia. As a young man he trained as a programmer and worked in the cryptography and software fields before moving into legitimate and, later, illegitimate business ventures.

E4M and early cryptography work

In the late 1990s Le Roux wrote E4M ("Encryption for the Masses"), a free, open-source, on-the-fly disk encryption program for Windows NT and Windows 9x systems that let users encrypt entire disk volumes, including support for hidden, plausibly deniable volumes. E4M was distributed with its source code and was accompanied by a manifesto in which Le Roux argued against government efforts to restrict strong encryption. The program went through several versions, with a final release (2.02a) appearing around 2000. Le Roux later worked with Shaun Hollingworth, author of the encryption program ScramDisk, and the two collaborated on DriveCrypt, a commercial encryption product sold by the German company SecurStar.

The TrueCrypt dispute

When the free encryption program TrueCrypt was first released in 2004, its code was based on E4M. Shortly afterward, SecurStar manager Wilfried Hafner publicly claimed that Le Roux had, while employed by SecurStar, taken E4M's source code and improperly released it for free redistribution, and asserted that all rights to the code belonged to SecurStar. The claim temporarily halted TrueCrypt's development while its authors sought to verify the legitimacy of the licensing. The dispute was never fully resolved in public, and it left a lingering legal question mark over TrueCrypt's origins for years afterward. In a 2016 U.S. court proceeding, Le Roux confirmed that he had written E4M but denied direct involvement in developing TrueCrypt itself.

Transition to a criminal enterprise

From the mid-2000s, Le Roux built and expanded RX Limited, an online pharmaceutical business that sold prescription drugs, including painkillers, without valid prescriptions to customers in the United States and elsewhere. Using the proceeds and organizational infrastructure of that business, he assembled a much broader transnational criminal network beginning around 2007, with operations reaching into the Philippines, Hong Kong, Colombia, Brazil, and parts of Africa. The organization diversified into narcotics trafficking, illegal logging, gold mining, money laundering, and arms smuggling, and it employed former soldiers and mercenaries, including men recruited through associate Joseph "Rambo" Hunter, to serve as enforcers and hitmen.

Violence and arms trafficking

Le Roux's organization has been tied to multiple killings in the Philippines carried out on his orders, as well as to significant weapons deals, including a 2008 shipment involving the cargo ship Captain Ufuk and the supply of arms to armed factions in Somalia between roughly 2009 and 2011. In 2012, associates working for Le Roux also attempted to smuggle a large quantity of cocaine by yacht as part of an expanding narcotics operation.

Arrest and cooperation

On September 26, 2012, Le Roux was arrested in Liberia after U.S. Drug Enforcement Administration agents, posing as representatives of a Colombian drug cartel, lured him into a sting operation. Following his arrest, Le Roux began cooperating extensively with U.S. federal authorities, providing information that led to charges against numerous associates, including hired killers and arms traffickers connected to his network. In exchange for his cooperation, prosecutors granted him immunity covering murders he admitted to having ordered. He pleaded guilty to multiple federal charges related to drug trafficking, weapons trafficking, and other crimes, and on June 12, 2020, he was sentenced in U.S. federal court to 25 years in prison.

Legacy and significance

Le Roux occupies an unusual place in the history of computer security: a programmer whose freely distributed encryption code helped shape one of the era's most widely used privacy tools, and who later applied his organizational abilities to running a large, violent criminal enterprise spanning multiple continents. His case has been documented extensively in investigative journalism and in U.S. federal court records, providing a detailed public account of the intersection between technical skill, online pharmaceutical fraud, and transnational organized crime.

Timeline

• 1972-12-24Paul Calder Le Roux is born in Bulawayo, Rhodesia (now Zimbabwe).
• 1998Le Roux releases E4M (Encryption for the Masses), a free open-source disk encryption program, along with a manifesto opposing restrictions on encryption.
• 2000A final version of E4M, 2.02a, is released before the project is discontinued.
• 2004TrueCrypt 1.0 is released using code based on E4M; SecurStar publicly disputes Le Roux's right to have released the E4M source code.
• 2007Le Roux begins expanding his online pharmaceutical business, RX Limited, into a broader transnational criminal network.
• 2008Le Roux's organization is linked to an illegal arms shipment involving the cargo ship Captain Ufuk.
• 2009Le Roux's network begins supplying weapons to armed factions in Somalia, continuing into 2011.
• 2012-09-26Le Roux is arrested in Liberia in a DEA sting operation and subsequently agrees to cooperate with U.S. authorities.
• 2016During U.S. court proceedings, Le Roux confirms authorship of E4M while denying direct involvement in developing TrueCrypt.
• 2020-06-12Le Roux is sentenced in U.S. federal court to 25 years in prison.