Paul Calder Le Roux (born 24 December 1972) is a former programmer, former criminal cartel boss, and informant to the US Drug Enforcement Administration (DEA).

In 1999, he created E4M, a free and open-source disk encryption software program for Microsoft Windows, and is sometimes credited for open-source TrueCrypt, which is based on E4M's code, though he denies involvement with TrueCrypt.

Le Roux was arrested on 26 September 2012 for conspiracy to import narcotics into the United States, and agreed to cooperate with authorities in exchange for a lesser sentence and immunity to any crimes he might admit to later. He subsequently admitted to arranging or participating in seven murders, carried out as part of an extensive illegal business empire.

Le Roux was sentenced to 25 years in prison in June 2020.

Early life

Le Roux was born on 24 December 1972, at Lady Rodwell Maternity Home in Bulawayo, in what was then the republic of Rhodesia (present-day Zimbabwe), and given up for adoption. His birth certificate gives his first name as "unknown" and makes no mention of his father. His biological mother's identity has not been disclosed; one source claims she was a poor teenager, while another states that his maternal grandmother was married to a US senator.

Aged two months, he was adopted by a couple living in the asbestos-mining town of Mashava and given his future name, Paul Calder Le Roux. Although several family members became aware over the years, his parents never informed him of his adoption, and Le Roux only discovered the truth in 2002. Le Roux also had a younger sister.

Following political events in 1980 that ended the Rhodesian Bush War and Robert Mugabe assuming power and ending white minority rule, Le Roux's family relocated to South Africa in 1984 for better schooling opportunities. They found a new home in the mining town of Krugersdorp, where Le Roux's father started a company managing coal-mining operations, soon bringing wealth to the family.

Shortly after, Le Roux was given his first computer in exchange for washing his father's car. As a teenager, he was described as tall, trim and handsome, though not very social and not interested in sports. He was obsessed with the video game Wing Commander, which he played on his gaming console connected to the family TV.

At around 15 or 16 years old, Le Roux was arrested for selling pornography following a police search of the family home. The family was able to keep the incident out of the public eye. Following his arrest, Le Roux became even more reclusive. An excellent student, he refused to learn Afrikaans—mandatory in South African schools — calling it a "dead language" and eventually dropping out of school at age 16. He enrolled in a local programming course, in which he excelled, completing the one-year course in eight weeks.

Upon returning from a family holiday trip to the US, 18-year-old Le Roux decided to leave South Africa, and departed to the UK eight months later. He found work as a programmer, and, in 1994, met his future wife, Michelle. After six months in the US, he followed Michelle to Australia in 1995. The couple married and Le Roux acquired Australian citizenship. They lived in Perth and Sydney. Reports are contradictory regarding children of the marriage – some sources mention a son, while others claim Le Roux's first child (a son) was with his second wife.

Le Roux has revealed little about his early life, and most of it was uncovered by journalist Evan Ratliff, relying mainly on an initially unnamed source close to Le Roux. He would later name Le Roux's cousin and former employee Mathew Smith as a source.

Internet activity and encryption software

Various Usenet newsgroup postings made by Le Roux are known from the second half of the 1990s. Some of them are highly technical encryption discussions, while others can be summarized as trolling. Le Roux would frequently post angry, sarcastic and offensive messages, including harsh verbal attacks against Australia as well as racist comments. On various occasions, he would later express his amusement at the reactions of other users.

In 1995, Le Roux appears as the owner of a business, World Away Pty.

Around 1997–1998, Le Roux began to develop E4M (Encryption for the Masses), which was first released on 18 December 1998. The product is capable of encrypting entire disks, and optionally of plausible deniability (denying the existence of an encrypted volume). Le Roux claimed the software had been written "from scratch". The software was released free of charge and with source code. In the "Politics" section of the E4M website, Le Roux published a kind of manifesto stating that governments are increasingly relying on electronic data gathering. Citing projects such as Echelon, linked to the five nation states which would become known as the "Five Eyes" more than a decade later, he stated that encryption is the only way to preserve civil liberties.

With no income from his previous two years of labour, Le Roux was struggling financially. He was divorced from his first wife in Brisbane in 1999. Sources close to Le Roux describe the divorce as "violent", while another states the couple parted ways amicably.

Le Roux relocated to Hong Kong, then to Rotterdam, where he married a Dutch citizen named Lilian Cheung Yuen Pui. The couple had a son soon after.

To monetize E4M, he launched SW Professionals in 2000. Based in South Africa, the company offered offshore programming, including E4M customization. According to its website, it had 5 to 6 employees. Le Roux himself was reportedly rarely seen in South Africa, and was still in a precarious financial situation.

In 2001, Le Roux was approached by Wilfried Hafner, a client with whom he had corresponded for several years about E4M. Hafner offered him a position in his newly founded company SecurStar. Le Roux was to build the engine for its upcoming DriveCrypt product, based on E4M and another product, Scramdisk (whose inventor, Shaun Hollingworth, had also joined SecurStar, where he still worked as of mid-2019). Both Hafner and Hollingworth describe him as a gifted programmer who would contribute innovative ideas. He was dismissed in 2002 upon Hafner discovering that Le Roux continued to work on E4M, incorporating some of the work he had done for SecurStar. Nonetheless, Hafner and Le Roux reconciled personally and stayed in touch for some time.

Around the same time, Le Roux was working on a gaming engine for an online casino he intended to launch in Canada and Romania. Hafner would later describe Le Roux as "not a marketer" and that he "didn't see how he could bring in the gamers to play." In 2001, Le Roux appears listed as a director of a company named SSD Software. SW Professionals went out of business in October 2002 and Le Roux solicited contract work with a Usenet post.

TrueCrypt release and controversy

In February 2004, the first version of TrueCrypt was released by anonymous developers who called themselves "the TrueCrypt Team", built on E4M code. As its developers remained anonymous, some of Le Roux's former SecurStar colleagues, including Hafner, suspected Le Roux of being involved but could not find any corroborating evidence. The actual authors remain unknown as of 2026.

According to Matthew Green, a computer science professor at the Johns Hopkins Information Security Institute and leader of the TrueCrypt audit in 2014, TrueCrypt "was written by anonymous folks; it could have been Paul Le Roux writing under an assumed name, or it could have been someone completely different."

Hafner sent a cease-and-desist letter to an email address associated with the TrueCrypt developers. The TrueCrypt Team immediately stopped development and distribution of TrueCrypt, which they announced on Usenet. Team member David Tesařík stated that Le Roux informed the team that there was a legal dispute between himself and SecurStar, and that he had received legal advice not to comment on the case. Because of this, he was unable to confirm or deny the legitimacy of TrueCrypt, keeping its development in limbo. A new version was released in June, but with a different digital signature and the developers now being referred to as "the TrueCrypt Foundation". The project received funding, the source of which is equally unclear.

Responding to the TrueCrypt controversy, Le Roux sent his last Usenet post, in which he wrote "the pure speculation here (often stated as fact) is damaging and in some cases libelous." This appears to be the last online appearance he made using his real name.

Le Roux's involvement with TrueCrypt still remains unclear as of 2016. Le Roux himself has denied developing TrueCrypt in a court hearing in March 2016, in which he also confirmed he had written E4M. On the other hand, he reportedly ordered employees around 2007 to encrypt their hard disks with E4M and later with TrueCrypt.

RX Limited

In 2003, Le Roux sent out a request to various Usenet groups, in which he solicited business contacts in the US:

Around 2004, at the advice of a lawyer in Costa Rica, Le Roux abandoned his online gambling activities and launched several web sites and call centres for the online sale of prescription drugs.

To place an order on these sites, customers would fill out questionnaires about their medical history and symptoms, order their chosen medication and pay by credit card. The questionnaires would get forwarded to doctors in the US, who would in turn write prescriptions for the drugs ordered, despite never having examined the patient in person. The prescription, along with the customer's order, would go to a pharmacy in the US, which would then ship the drug. Both the doctor and the pharmacy would receive a commission for the order. Prosecution in the case alleged in 2014 that "some of [RX Limited's] customers' hands are cold and 6 feet under right now."

RX Limited advertised its services through spam email. As messages pointing to one particular web site would quickly get blocked by spam filters, RX Limited would open up new sites. Initially the new domains were purchased individually from domain sellers such as GoDaddy, until RX Limited set up its own domain seller, ABSystems, allowing RX Limited to spawn new domains on a much larger scale. By 2012, LegitScript estimated that more than half the rogue online pharmacies in the world were registered through ABSystems.

The business operated in a legal gray area, but many employees and pharmacists had the impression that it was acting legally. Each order came with a prescription, and the system would keep track of customers' orders and block unusually large orders arriving within a short period of time. The system also seemed to adapt to apparent changes in regulation. Pharmacists were shown the licenses of the doctors writing the prescriptions and recruiters would stress the fact that the business was not selling controlled substances. In at least one instance, a pharmacist was given the contact details of a former DEA agent, who confirmed there would be no legal issues in shipping any of the medications offered by RX Limited.

The business was highly profitable. The US Internal Revenue Service calculated that RX Limited owed more than $1.5m in tax from 2005 alone. The debt is still outstanding.

Medications

Medications offered through RX Limited's web sites included: Fioricet (active ingredients: butalbital, acetaminophen and caffeine), a treatment for tension headaches and migraine Propecia (active ingredient: finasteride), a treatment for hair loss Soma (active ingredient: carisoprodol), a muscle relaxant to treat back problems Ultram (active ingredient: tramadol), a synthetic opioid painkiller Viagra (active ingredient: sildenafil), a treatment for erectile dysfunction

Call centres