Paul Le Roux was basically a spammer. A guy who flooded computers with unsolicited email and shady websites offering to treat hair loss, migraine headaches, and erectile dysfunction. Tired of standing in line at pharmacies? Tired of sitting in doctors' offices? Get the meds YOU WANT online! Online. That was the key. Jeff Bezos saw it and built Amazon. Paul Le Roux saw it and went to jail.
Interestingly, it's not entirely clear that what Le Roux did was illegal. Or, at least, what he did from 2004 to around 2008—the first years in which he made serious money with what was in essence an internet start-up. Yes, he used annoying spam and an endless succession of websites (each designed to slip through the latest iteration of Google's search suppressions). But the business itself was fascinating.
First, Le Roux lined up pharmacies—typically drug stores in small cities like Oshkosh, Wisconsin: the old local mom-and-pop places getting plowed under by the big box chains. Even "lined up" is too old-fashioned a phrase for what the man did. If Le Roux was a genius, his brilliance lay in realizing earlier than others just how cheap it was to let the Web act as an identifying algorithm. He'd spam pharmacies with offers of business: a few dollars for each prescription filled. Send out enough of those emails, set up enough websites soliciting pharmacists, and someone would bite.
Meanwhile, he spammed doctors: anybody with a license, down at the low end of the medical profession. He offered reasonable money for just minutes or even seconds of work. Customers responding to online offers for, say, the muscle-relaxant Soma would fill out a brief form online, the doctors would sign it, and the pharmacists would complete the prescriptions. Easy as pie. A string of call centers (first in Israel and then in the cheaper Philippines) handled interactions with customers.
The whole thing might have been illegal. Probably was illegal. But American law was uncertain enough that it needed testing in court. And Le Roux seems to have understood that if his business was high profile—a real company, aiming (like most computer start-ups) at cashing out with an eventual stock offering—he would be the one the FDA tried to prosecute in a test case. The one the newspapers hounded. The one with a physical address for the tax authorities to raid.
Besides, if he were running a traditional business, he would have to wear a suit and tie, sit in an office, and meet with investors. Why would he want to do that when he was doing fine without it? By 2008, reportedly, his revenue had reached $250 million a year, an astonishing figure for a business begun in 2004.
Not paying taxes helped, of course. A white kid who grew up in Rhodesia and South Africa, Le Roux dropped out of school, took a computer-training course, and left for Great Britain in 1989 to become a programmer at age 17. It was there he met an Australian girl he followed to the United States and then Australia, marrying her in 1995. Over the next few years, he developed E4M ("Encryption for the Masses"), an open-source disk-protection program—and he is often identified as an originator of TrueCrypt, a more sophisticated open-source encryption program. Along the way, he did piecework programming jobs, tried and failed to monetize his encryption work, and attempted to start an online gambling site.
None of that made him much money. But RX Limited, his idea for online medicines, would start the cash rolling in. Originally, he used Go Daddy and other common commercial domain-name sellers to register RX Limited's succession of websites. But his old encryption work made him realize how vulnerable he was. So he started ABSystems, his own domain seller, which conveniently allowed RX Limited's websites to avoid having identifiable physical mailing addresses. He started his own email company,, Fast-Free-Email.com, which conveniently failed to preserve emails, ensuring that it could not respond to subpoenas.
And then he became a criminal. A real-life gangster-type bad guy. Maybe it was boredom. By 2007 he was clearly looking for something new. He tried to get the government of Zimbabwe to sell him leases on confiscated farmland (maybe as part of a plan to set up a coup against President Robert Mugabe). That same year, he toyed with logging operations in Congo and the South Pacific island nation of Vanuatu.
Or maybe, given the dubious nature of his main business, he already thought of himself as a criminal—a successful criminal, worth millions. He started acting as a middle man for drug deals, getting high-grade North Korean meth from Chinese sources. He dabbled in the weapons trade, working with Iran. He ran gold out of Hong Kong and Mali. He worked deals with Somali pirates. And before he moved to Brazil in 2012 (to take advantage of the extradition laws) he got fat—orca fat, well over 300 pounds. Along the way, he murdered at least one person himself and hired ex-soldiers to kill others.
And then he got arrested. A disgruntled employee—angry about Le Roux’s failure to offer him food at a brunch—worked with American DEA agents to lure him to Liberia in the spring of 2012. He was arrested for drug trafficking and flown to New York. Which is where Paul Le Roux pulled off his greatest scam.
Tantalized by his hints of connections with North Korea and Iran, certain he was a criminal mastermind who knew everyone involved in international crime, the American authorities offered him a deal. If he pleaded guilty to a few crimes (12 years or so in jail) and helped hunt down other criminals, there would be no prosecution for anything else he revealed. With that proffer in hand, Le Roux promptly confessed to his murders, his scams, his drug deals, and his gun running.
The feds kept him hidden for years—only this spring will he be in court for sentencing—while he helped set up other criminals. But the criminals proved only to be those who had worked for Le Roux. The North Korean and Iranian contacts proved too distant to touch, and the Americans’ vision of cracking international crime never materialized. Le Roux basically sold out his subordinates, and for those smaller fish, he got the prosecutorial deal of a lifetime.
Both the reporter Evan Ratliff, in his new book The Mastermind, and Elaine Shannon, in Hunting Le Roux, tell this story upside down. They start with the gangster tales: Paul Le Roux is a murderer! A drug dealer! An illegal arms-dealer! A bad, bad guy! And only after all that hype do they roll back the story to the online entrepreneur from Africa.
And maybe they're right to do so. They have books to sell, after all. The better of the two is The Mastermind, mostly because Ratliff is a dogged reporter who began tracking the story around the world, based on only the smallest of hints that the feds had turned Le Roux. Much of the known biographical data comes from Ratliff’s work finding family members and stray acquaintances. Still, the structure of the book makes it more annoying than it has to be, with too much of the reporting turned to a kind of self-reporting about how Ratliff pursued his subject—a nonfiction genre that last seemed exciting back in 1934, when A.J.A. Symons used it in The Quest for Corvo.
Elaine Shannon has lined up film director Michael Mann to promote her book and promise a movie version, but too much of Hunting Le Roux reads like propaganda for the DEA, with brave and oh-so-resourceful government agents somehow managing to take down the kingpin of all crime. Her sources are clearly feds involved in the case, and she ought to have looked at their self-promotion with a much more skeptical eye. For that matter, she ought to have written the book with a much less excitable prose.
Overwrought, really, is what the tale of Paul Le Roux comes to seem. He wasn’t a mastermind or a kingpin. He wasn’t the godfather of international crime. He was the founder of a dubious internet business—who then had a subsequent run of four or five years in which he thought his success made him a real criminal, acting the way he imagined real criminals did. The feds convinced themselves of the same overwrought fantasy, which is why this murderer isn't going to jail for life. And the authors of these new books have fallen, too, into the delusion.
Try turning the story the other way around. Paul Le Roux was basically a spammer who got lucky. Then murderously stupid. And then caught.