Our journey begins at Unit 5C, 75 Lakemba Street, Belmore, a block back from the railway line in a tree-lined pocket of Sydney’s west. This was where it started for Paul Calder Le Roux, a newly married computer coder with a big idea.
Those who knew him back then, in the mid-1990s, remember a tall, awkward-looking man who spoke with a rough and ready southern Africa accent. He had left his native Zimbabwe as a teenager and migrated to Australia via London, where he met his wife, a Gold Coast woman who discovered that he lived for his work.
Le Roux evidently wanted to do good. He worked day and night in that cramped flat to write a program called E4M — Encryption for the Masses.
In effect, this created a digital safe to lock up the secrets contained in a personal computer. The data protection system was a leap forward on anything else on the market at that time.
Le Roux uploaded it to the internet as freeware. Never before had technology of its kind been made available to the public.
And never before would law enforcement and intelligence agencies across the globe have such cause to rue an Australian invention or the man behind it.
Like Le Roux, E4M ran off the rails. While he became the lord of a criminal empire that reached to blood diamond smuggling in Africa, drug-running in and out of North Korea, sponsored murder and dirty wars in forgotten corners of the world, the sinister child of his original encryption program, TrueCrypt, would be adopted by terrorists with al-Qa’ida and Islamic State to mask their crimes.
No one knows for certain who developed TrueCrypt, which emerged in 2004, after Le Roux left his wife and the quiet of suburban Sydney to embark on his life of high crime. But those who have followed his rise and fall see his fingerprints all over the super-cipher.
“I’m not sure if TrueCrypt would have existed if it wasn’t for him publishing his source code to the world,” says former colleague Shaun Hollingworth, a British computer programmer who worked with Le Roux at a German software company, SecurStar, in 2000, a pit stop on his road to infamy. “I doubt it, to be honest. It was certainly heavily based on E4M. They didn’t even bother changing the look and feel of the user interface.”
Last year, Australian Federal Police say TrueCrypt was found on the computer of a Melbourne teenager accused of plotting a terrorist bombing. According to court documents, police were unable to break the encryption. They gained access only after coming across the 17-year-old’s password. Bomb-making instructions allegedly were among the encrypted files.
In December 2012, US traitor Edward Snowden, then still a contractor to the US National Security Agency, hosted a “crypto party” in Hawaii where he lauded TrueCrypt as being beyond the reach of Western intelligence services. When Snowden betrayed US national secrets, TrueCrypt was known to have been used by several of those who received and published the explosive document dumps. The software was described as “military grade”, as though it were a weapon itself.
Says Hollingworth: “I must admit that I did wonder if Paul was involved in it and, if so, I’m sure there would have been money behind it.
“The strange thing about it was that they (TrueCrypt’s distributors) always seemed to have access to information that was hard for anyone else to get, even those of us working professionally in the encryption business. Paul was a genius at sussing things out and would have been one of the few people I’ve known who could have done this.
“Paul seemed to have a gift in being able to work out how to achieve things software-wise that he wanted to do, quicker than anyone else I’ve ever met in all my 30-plus years in software development.”
But in May 2014, the website used to distribute the software was updated with a warning in red to users: “TrueCrypt is not secure as it may contain unfixed security issues.”
People wondered what it meant for TrueCrypt and its shadowy progenitor, Le Roux. Conspiracy theories abounded. What no one in the cryptology community knew was that he had spent the previous 18 months working with US law enforcement agencies to identify, trap and arrest members of the global criminal network of killers and drug dealers he had created, according to US prosecutors.
Across 15 months, an Inquirer investigation has followed in his footsteps from Sydney to Africa, London and New York, interviewing family and associates, detailing the lives he destroyed far from prying eyes, to piece together his destructive life and crimes. This is the story of the most powerful, murderous and determined criminal to emerge from this country.
Le Roux’s former wife is a bespectacled professional woman who can’t believe what he became. The man she knew would talk of his birth in the Zimbabwean city of Bulawayo on Christmas Eve 1972 and how his family moved to South Africa when he was 11. He spoke admiringly of his father’s work as a mining contractor, sealing damaged concrete, and of his childhood in Krugersdorp, outside of Johannesburg. He was a nerdy boy who resolved to make a career out of software programming. He wanted to see the world and vowed never to be tied down in one spot.
The couple met in London in 1994, when Le Roux was 21, holding down a legitimate job, and within a year had moved to Australia and were married. There was no time for a honeymoon; Le Roux was too busy with E4M. His day job was with a London software company, work that took him frequently to Britain and the US. Soon after he released E4M, they divorced — amicably, Inquirer has been told — and he left Australia for good.
Clearly, he struggled before landing a job at SecurStar, a legitimate supplier of computer and phone encryption services. In 2002 Le Roux posted a plaintive plea for work on an internet message board: “Hi guys, I’m looking for crypto/or other contract programming work, anybody out there have anything available? If your (sic) reading this group probably I don’t need any introduction, but I can send my CV as needed.”
Within six months, however, his confidence had returned. Le Roux was describing himself as a “private investor based in Rotterdam”, in The Netherlands, and was advertising for a US-based partner for a “new online business I am setting up in the states”. During the following 12 months, a suite of professionally designed websites went live, targeting US consumers. Call centres were set up all over the world — from Florida to The Philippines and Israel. Each promoted “highly stringent” online pharmacies, where prescriptions from “legitimate US doctors” would be properly dispensed and sent by mail. The drugs concerned were often powerful painkillers.
The business was called RX Limited and its corporate registration was probably the only thing legal about the operation, US prosecutors now allege. But it was immensely profitable. The US Internal Revenue Service calculated that RX Limited owed more than $US1.5 million in tax from 2005 alone. The debt is still outstanding.
For years, no law enforcement agency in the US or elsewhere had Le Roux or RX Limited on their radar, despite the company reaping annual revenues of up to $US200m. It wasn’t until September 2007 that the US Drug Enforcement Administration began investigating. It would take agents another five years to catch Le Roux.
Meantime, he was funnelling funds into forestry concessions in Mozambique in southeast Africa and the Pacific island state of Vanuatu, as well as diamond concessions elsewhere in Africa. He traded gold bullion in Hong Kong, Mali and the Democratic Republic of the Congo. US prosecutors say he also bought cocaine in South America and manufactured and trafficked crystal methamphetamine, or ice, across Asia.
His business managers knew him as “Alexander”, “Johan”, “John” or the “Dutchman”.
“This guy, I thought he was in some sort of mafia,” says a former associate tracked down by Inquirer in South Africa. “Money was never the issue.”
He hired a former US Army sniper instructor, Joe Hunter, as a low-level operator in Mali and the DRC before promoting him to head of security for the entire business. By 2009, Le Roux’s henchmen were being linked to gun-running in lawless Somalia on the Horn of Africa. His “general” there, identified by the UN as former Belgian soldier Erwin Bockstaele, was said to command a private army that had been enlisted by the Ethiopian government to take on the jihadists of al-Shabab, a vicious al-Qa’ida offshoot. For a time, the 220-strong militia looked to set up as a contract force to police the Somali coast against pirates, investigators told Inquirer.
Instead, the group’s main compound sprouted greenhouses to grow seedlings for opium poppies. Crops of marijuana and coca also were planted, only for Le Roux to discover his men were cheating him, paying themselves twice the normal rate. The operation was shut down on his orders.
At the same time, a battered and rusting freighter was steaming across the Indian Ocean bound for Indonesia on its maiden voyage for its new owner. The MV Captain Ufuk was already four decades old when Le Roux’s La Plata Trading company in The Philippines bought it. Le Roux would have been confident that the ship and its cargo of assault rifles, loaded in Jakarta, would not be touched by authorities when it entered Philippine waters. La Plata Trading had an end-user certificate that listed the owner of the rifles as Mali’s Ministry of Internal Security and Civil Protection, according to court documents obtained by Inquirer.
The problem for Le Roux came from an entirely unexpected quarter when the pregnant wife of the skipper, Briton Bruce Jones, became ill as the ship passed Subic in The Philippines. Jones handed over to another captain and left on a yacht; coincidentally or not, the ship was raided by the Philippines Bureau of Customs when it docked in Mariveles Port in August 2009.
Jones went into hiding and was gunned down in his car north of Manila 13 months later. Soon enough, another British man linked to Le Roux’s criminal enterprise, David Smith, died violently. He was reputed to have been Le Roux’s closest friend.
Part-time real estate agent Noimie Edillor — who happened to have the same name as a woman identified as a La Plata Trading employee and was the wife of a Filipino Customs officer — was shot dead on a Manila street on June 23, 2011. Contacted on Facebook, neither her widowed husband nor sister would discuss her death, or whether she had had connections with Le Roux. Hunter was later recorded by the DEA boasting of killings that his boss had ordered — including that of Edillor, to whom he referred as a Customs agent`, perhaps because of her husband’s occupation.
“There was a lady. She was a Customs agent. I guess they had some kind of business … with her, when they get stuff through customs right? But she didn’t … they paid her and she didn’t do it,” Hunter said during that March 2013 meeting in Phuket, according to a transcript filed in a New York federal court.
“Our friend … another guy had that job and ah, they was doing the surveillance on her and everything and they saw that she was also a part-time real estate agent.”
The killers posed as potential clients and met her at a house she was marketing. “They didn’t even go inside,” Hunter said. “They shot her at the door. Left her there.”
Le Roux was beginning to feel the heat of the multiple investigations. He had tried to limit his exposure, setting up shell corporations and front companies in country after country, predominantly in other people’s names, using employees to launder his illicit gains.
Australian-Israeli dual national Doron Zvi Shulman initially went to work for Le Roux handling contraband gold and diamonds, as Hunter had done.
“All we know is that as a young student he was recruited into working for what he believed was a legitimate investment company and only found out after his arrest that the financial backing for the company was questionable,” a relative of Shulman said through Facebook. Shulman was arrested in April 2012, before raids on Le Roux’s business premises, houses and warehouses in Hong Kong turned up millions of dollars in gold and diamonds that were being used to launder cash — and 24 tonnes of ammonia nitrate for which the young man was never prosecuted.
According to Hong Kong court documents, two other Israelis were flown in after Shulman’s arrest to retrieve even more gold bullion. During their trial, evidence was given that they were being instructed by the boss, “John”, in The Philippines. In the end, Shulman was jailed for five years for laundering 342kg of gold bullion, two diamonds and 5kg of silver grain worth more than $US25m.
Three other people arrested over the matter — including a man named Ivan Vaclavic, holding Bulgarian and Slovakian passports and a plane ticket to Rio de Janeiro in Brazil — jumped bail in Hong Kong. The trio had entered the Chinese territory in the weeks following Shulman’s arrest and allegedly had receipts for millions of dollars that were wired from Hong Kong to offshore accounts.
Later in 2012, a man who passed himself off as Ivan Vaclavik, with those same Bulgarian and Slovakian passports, cropped up in news reports in central Europe over a cocaine run that went bust when the yacht carrying the haul hit a reef off the Pacific island state of Tonga, en route to Australia from Ecuador.
According to Slovak media reports, Vaclavik was an alias used by fugitive Maros Deak. The DEA had been tipped off about the shipment as it left Ecuador and notified the Australian Federal Police. The body of another Slovak national, identified as Milan Rindzak, was found on board the stricken yacht JeReVe along with 200kg of abandoned cocaine. The whereabouts of Vaclavik/Deak remains a mystery: no one has been arrested or charged over the failed shipment.
By then, Le Roux was in US custody, having finally over-reached. He had been trying to set up a new deal to manufacture and smuggle ice into the US, and to send more cocaine to his suppliers in Europe. According to indictments before US federal courts in New York and Minnesota, Le Roux met a middleman in a Rio de Janeiro high-rise on May 11, 2012, then sent a 24.2g sample of his near-pure methamphetamine to traffickers in Liberia to prove his credentials. He asked for a barter: 100kg of ice for 100kg of cocaine.
When he flew to Liberia in September 26, 2012, for a follow-up meeting, the DEA pounced, arresting him. The middleman was an informant who had set up a sting to snare Le Roux.
Special Agent James Stouch told Le Roux that he was facing drugs charges in the US. For some reason, Le Roux apologised, but then refused to comply when told by the agents he was to be put on a chartered jet to New York. He was bundled into a car and on the way to the airport had a change of mind, the DEA would say later.
Le Roux turned, pledging to co-operate. On landing in the US, he emailed his associates and employees, pretending he was still free. He even helped the DEA set up a Gmail account that allowed agents to see every email he sent or received in his personal account.
In secret 2014 federal court hearings in the Southern District of New York — which Inquirer can now detail — he made a series of extraordinary admissions, including that he had illegally sold prescription pills via RX Limited, and laundered the cash via fraudulent means; that he conspired to traffic crystal methamphetamine into the US and ordered or assisted in the murder of seven people.
Le Roux owned up to computer hacking and bribery — and, jaw-droppingly, to selling to Iran technology believed to be in the form of a missile guidance system.
The coffee shop in which we meet in South Africa could be any all-day breakfast bar, anywhere in the world. The arms dealer takes his seat and scans the room, his back to the wall.
In April 2013, the arms dealer had a meeting in Mauritius with men claiming to work for Le Roux. They initially said they wanted Iranian-made arms and asked if the arms dealer had a network that could supply them.
Then they changed the request and dropped a bombshell: Le Roux had sold a missile guidance system to Iran. The software was uploaded to a secure website, but “contact went dead at the Iranian end”.
Money was owed. Could the arms dealer find out what had happened and try to recover the money owed to Le Roux?
The arms dealer never sought out the requested information because he demanded an upfront payment for his services — something Le Roux never had issues with in other business dealings.
“If they could cross that hurdle, I would know they were serious,” he told Inquirer.
He heard once more from them about the request, and heard nothing more about the deal until his fears were confirmed: US authorities had charged Le Roux over an illegal sale to Iran and he had struck a plea deal.
According to the indictment against Le Roux filed in the federal court in the Southern District of New York, Le Roux began his dealings with Tehran as long ago as 2009, breaching strict embargos when he “did export, and cause to be exported, re-exported, sold, and supplied” technology to Iran. Tacked on the end of that count in his document are allegations that he was involved in the murders of seven people outside the US in just 2010 and 2011 alone. Le Roux has admitted to the allegation in court, along with trafficking crystal methamphetamine into the US, hacking a computer and organising a bribe for foreign officials to stop an unnamed person from being extradited to the US.
On March 2, Le Roux made his first appearance in a public court. With the exception of a dark woolly beard, he looked much the same as he did in the few grainy photographs that are available of him as a younger man. There was no slouch in his 188cm frame, and his silver hair was fashionably styled.
Confident and defiant, he told the Minnesota courtroom — where an RX Limited underling is awaiting trial — that his co-operation had come about solely because of his “bad situation”. Having protected the truth of his criminal life for all those years, the keeper of secrets was giving them away.
LE ROUX’S LIFE AND CRIMES
1972
Born in Rhodesia/Zimbabwe on December 24.
1984
Family relocates to South Africa, where his adopted father becomes a mining contractor.
Circa 1990
Finishes high school in Krugersdorp, on Johannesburg’s fringe. Already a proficient programmer.
1993-94
Programming work takes him to London, where he meets a young Australian girl with whom he begins a relationship.
1995
Follows his Australian girlfriend to Sydney. Retains his programming contract with his London employer. The pair live in Britain and the US for six-month stints. They eventually marry.
1997
Releases Encryption for the Masses, or E4M, after several years of development. It is open source and encrypts hard drives and files “on the fly”. It eventually becomes the building block for TrueCrypt.
1999 to 2000
Newly divorced with Australian citizenship, Le Roux moves between London, Hong Kong and Rotterdam continuing his programming work.
2001
Begins work at German encryption software company SecurStar. Quits the following year.
Circa 2002
Discovers he is adopted, causing a personal crisis. Remarries and is temporarily short of work. Within the next two years he has his first child, a boy.
2003
In Rotterdam, advertises for US-based investors to join a “new online business I am setting up in the states”.
2004
TrueCrypt released early in year. SecurStar accuses Le Roux of illegally allowing TrueCrypt to use E4M’s code, which the company claims now belongs to it.
May: RX Limited launches a suite of online prescription pill stores and call centres in Asia and Africa.
2007-09
Hires former Israeli intelligence officer turned lobbyist Ari Ben-Menashe, a key figure in the Iran-Contra controversy, purportedly to purchase land in Zimbabwe.
2007
Sets up a range of companies in Britain, Hong Kong and The Philippines (where he is based), including Southern Ace and La Plata Trading. Hires former US army sniper instructor Joe Hunter, initially to buy and sell gold in Mali. Begins buying forestry concessions in the Pacific Islands and Africa. Purchases gold and diamond mines in Africa. Marries a third wife in September. DEA begins investigation into RX Limited.
2008-09 to 2011
Establishes a private army based in Somalia near the Ethiopian border. Sets up large greenhouses to grow cannabis, coca and opium poppies, and considers creating an anti-piracy base.
2009
August: Shipment of Indonesian-made assault rifles, belonging to La Plata Trading, seized in The Philippines. They have an end-user certificate for Mali.
2010
Hires Australian-Israeli Doron Zvi Shulman to buy and sell gold in Hong Kong to launder money.
September: Captain of the boat containing the assault rifles killed outside Manila.
2011
Le Roux named in a UN report on the Somali operations.
June: Noimie Edillor, believed to have worked at La Plata Trading, shot dead.
November: Begins establishing Brazilian base, setting up a shell company. Begins dealings with a Colombian cocaine cartel and has a secret family in Rio.
2012
February: A former US Army soldier carries out contract killing of another woman in The Philippines.
April: Le Roux is contacted by an informant for the US Drug Enforcement Agency, asking him to set up a crystal methamphetamine factory in Liberia for South American drug traffickers.
Twenty tonnes of ammonium nitrate, gold and diamonds seized in Hong Kong, Shulman arrested. Dutch, Filipino and Israeli underlings rush in to move millions of dollars out of Hong Kong and flee the country.
August: Two shipments of cocaine, bound for Australia and Asia, leave Ecuador. AFP tipped off to the Australian shipment.
September: Arrested in Liberia, brought to the US.
October and November: North Korean-made crystal methamphetamine seized in Thailand and The Philippines
November: Australia-bound yacht discovered smashed on a reef in Tonga.
Late 2012: Orders Hunter to collect resumes for a new security team to protect him and Colombian partners, as part of a DEA sting operation.
Late 2012-13
In frequent contact with business managers around the globe. Organises range of meetings on behalf of US authorities.
2013
January: Contacts former associates over another shipment of North Korean crystal methamphetamine.
April: Meetings set up with drug traffickers and arms dealers as part of ongoing investigations.
May: Orders hits on an employee who tipped off authorities to the cocaine shipment and a DEA agent, as part of a sting operation.
September: Hit team arrested and gradually brought to the US for prosecution.
Men involved in organising the second North Korean crystal methamphetamine shipment arrested and brought to the US
October: RX Limited managers indicted in the US.
2014
January: In secret court hearing in New York, pleads guilty to his involvement in RX Limited.
December: In secret court hearing in New York, pleads guilty to selling technology to Iran, trafficking crystal methamphetamine into the US, ordering or involvement in seven murders, fraud and bribery
2016
March: Appears for the first time in public since his arrest, to testify in the case of an RX Limited manager in Minnesota