The Mastermind Episode 3: He Always Had a Dark Side

How did a Usenet troll and encryption genius become a criminal mastermind?

By Evan Ratliff

One

For a man who built an empire in pixels, Paul Le Roux seemed like a digital phantom. After his name surfaced in the press in late 2014, I spent the better part of a year trying to understand him through the same means by which he’d directed his massive pharmacy business: the Internet. Late at night, I would open my laptop and plunge into an online wormhole, searching for clues about who Le Roux had been and what he became.

There I found another Paul Le Roux, from another time—one who’d left his trace in archived copies of long-dormant websites and message boards. This Le Roux had been famous among a small community of hackers and privacy geeks in the early 2000s as the author of an important piece of encryption software. Before encryption was a mainstream idea, before Apple defied a U.S. government request to provide a method to unlock our phones, this Le Roux had written the underlying code of a program that, a decade and a half later, the National Security Agency still could not break.

The question was: Could the Le Roux who politely answered jargon-laden posts about encryption software be the same one who ordered the murder of a real estate agent over a bad deal on a beach house? At first I thought I would never know. The former Paul Le Roux seemed to have disappeared from the Internet in 2004. Encryption experts I contacted had no idea what had become of that Le Roux, and there was no evidence linking him to the man known for drugs and gun running.

One night in October, I had been at the computer for hours when I finally found the missing link. It was a website once registered to the encryption Le Roux, in the early 2000s, and later transferred to a Philippine company controlled by the crime-boss Le Roux. My immediate reaction upon discovering this connection was a sudden and irrational fear: Le Roux was something new, a self-made cartel boss whose origins were not in family connections but in code. Not just any code, but encryption software that would play a role in world events a dozen years after he created it.

I stared at the address on the screen, a post-office box in Manila, left now with a still larger mystery: What had turned the earnest, brilliant programmer into an international criminal, with a trail of bodies in his wake?

One way that hackers and government agencies break into encrypted files and communications is through something called a brute-force attack. The process involves trying every possible combination of letters, numbers, and symbols that might make up a password. Brute-force attacks require enormous computing resources, and the strongest encryption renders them impossible simply by making the number of combinations so large that it would take lifetimes to find the correct one.

When I began my research into Le Roux, he struck me as a kind of encrypted mystery. A few scant details about his criminal existence had been reported in the media, mostly speculations about the mythological size and scope of his empire, but there was little about who he was or how he had built it.

At first I tried my own version of a brute-force attack. Le Roux’s name had surfaced in a court filing associated with the case of Joseph Hunter, his ex-enforcer, and another connected to RX Limited, his prescription-drug firm. I made a list of every name, company, and location in the documents of those cases and began looking them up online, separately and in combination.

Amid the vastness of the Internet, there were an almost infinite number of ways for me to search for evidence of his existence. I would start with a scrap of information—say Your-pills.com, one of the thousands of sites affiliated with RX Limited—and trace its connections. Who owned the site and when? Which mailing address was it registered to? Each of those formed a new starting point.

After months of rote data collection, I had amassed tens of thousands of pages of research. There were snippets from long-dead message boards from the early 2000s, Hong Kong legal databases, and obscure newsletters put out by the Australian Federal Police. Here was Le Roux listed as a director of a company in the UK called SSD Software in 2001. There was his name popping up in a 2008 FCC complaint regarding a company in Florida making a marketing call to someone on the National Do Not Call Registry.

The data points were tantalizing, but ultimately the mystery was too complex for brute force. Another way to crack encryption is called a back door. If a government can convince a software maker to create a secret way into a program, and to share that key only with the government, then the secrets protected by that software will reveal themselves.

I needed a back door into Paul Le Roux’s life. Then, two weeks ago, a key dropped into my inbox.

Two

“Hi, interesting story on PLR.” The email began so mundanely that at first I ignored it. It arrived on March 10, from a Gmail address that included the name Lulu. “I look forward to reading your series.” Then came the part that made my hair stand up.

He also had a legitimate Congolese Diplomatic passport in his own name and a Bulgarian passport in another name. He is an interesting character.

Cheers

For months I had been contacting people that my online searches hinted might have worked with, or even be related to, Paul Le Roux. I’d teamed up with Natalie Lampert, a young reporter in New York City, and together we’d sent emails and Facebook and LinkedIn messages to dozens of people seemingly connected with Le Roux—related companies and addresses, not to mention those with a Le Roux surname. The responses had been discouraging.

Something in Lulu’s email address reminded me of a person I had written to before. I sent that person another message and, a few hours later, got a response:

lol, no problem, please just let’s keep it to the other email.

That didn’t take you long at all

A few days after that email, at 4 p.m. on a Saturday my time—11 p.m. his—Lulu and I arranged to meet online for our first conversation. I was hunched over my laptop in a hotel lobby in Manhattan. When his handle lit up, we exchanged a few pleasantries, but I was eager to dive in. I asked him to start at the very beginning. “So do you know exactly where PLR grew up, what his family situation was?”

“Yeah, of course,” he said. “I am related.”

From there, Lulu and I started chatting* every few days. I can’t say how I’d figured out the connection between his anonymous email and the person I’d emailed previously. I can’t say what service we used to communicate, nor where Lulu lives, nor what he does. Where I was able to, I have confirmed what he told me through other sources—including key information that I verified with former law-enforcement officials with direct knowledge of Le Roux’s case. In a few instances, I have relied exclusively on his account. To corroborate his story, Lulu sent me documents that only someone very close to Le Roux would have, and he described Le Roux’s dealings with individuals whose connections to Le Roux have never been reported in the press. In the end, I came to trust what he told me, some of which was unflattering to Lulu himself.

Paul Le Roux was born on Christmas Eve, 1972, at Lady Rodwell Maternity Home in Bulawayo, the second-largest city in what was then called—by the white minority that governed it, at least— Rhodesia. His birth mother gave him up for adoption. On his birth certificate, a copy of which Lulu sent to me, his first name is listed as “UNKNOWN.” At the bottom, however, the newborn’s fate is outlined succinctly: “Child to be known in future as: Paul Calder Le Roux.”

In our chats, Lulu was genial and happy to talk. “Go for it, mate,” he’d say. “I’m in no rush, just ask.” He fielded any question I put to him, although he was rarely expansive in his replies. He was particularly protective of Le Roux’s birth mother, making me promise not to reveal her name. “Sad and interesting story,” he said. “His real mom’s mom is married to a U.S. Senator.” When I asked him who the Senator was, he said, “That I can’t say, mate. That’ll get me shot.” (I tried all sorts of strategies to figure out if this was true, but for now I’ve had to leave it unconfirmed, another legend following Le Roux.)

Le Roux was adopted by a family living in the asbestos-mining town of Mashava. “His adoptive parents were really nice,” Lulu said. “They loved him very much.” His father worked as an underground mining manager at the giant Gaths and Shabanie mines, which at one point produced 140,000 tons of asbestos a year. He had a younger sister and was well-loved by the extended Le Roux family. “All the cousins adored him,” Lulu told me.

*For The Mastermind book, Lulu agreed to go on the record under his real name, but I am leaving him anonymous here to reflect the original telling of the story. 

In 1980, Robert Mugabe became prime minister of what would now be called Zimbabwe, ending minority white rule in the country. Four years later, when Le Roux was 12, the family relocated to South Africa, where Paul’s mother believed they would find better schools for their precociously smart son. Krugersdorp, their new home, was also a mining town. Le Roux’s father started a company that managed coal-mining operations, and the family was soon well-off.

Lulu recalled that Le Roux was tall, trim, and handsome as he grew into his teenage years, but never particularly social. In a culture where a kid of his size might have been expected to try his hand at rugby, “he hated sport,” Lulu told me, favoring video games played on a console hooked up to the family TV. As a teenager, Le Roux’s love for the game Wing Commander, in which the player pilots a spacecraft into battle, bordered on obsession.

Not long after the move, in exchange for washing his father’s car, Le Roux was given his first computer. After that, “he was completely anti-social,” Lulu explained. From his first glimpse at a computer screen, Le Roux became interested in creating his own worlds. “Every time we went there afterwards he was always holed up in his room,” Lulu said. “I remember going in and seeing lines and lines of numbers.”

I found this image of a teenaged Le Roux jarring. It wasn’t that I was surprised that he could have discovered his identity in computer code. It was that his story sounded more like that of a programmer turned entrepreneur like Bill Gates or Mark Zuckerberg than of a crime boss like John Gotti or Viktor Bout.

Lulu told me that when Le Roux was 15 or 16, in the late 1980s, the local police raided the family home and arrested Paul for selling pornography. (I’d heard rumors of this before, from an employee who worked closely with him.) The family was scandalized but managed to keep the story private. After, Le Roux turned even more inward. He was an excellent student but despised the idea of learning Afrikaans, compulsory in South African schools. “He said it was a dead language and he didn’t want to learn it,” Lulu said. At 16, he dropped out of high school and decided to follow his interest in computers, taking a local programming course. Family lore has it that after he spent one class explaining some technical fact to the teacher, he got a letter saying he no longer needed to attend. He then completed a year’s worth of material in eight weeks.

What propelled Le Roux out of his parents’ home at 17, Lulu told me, was a family trip to the U.S.—Disneyland, the whole works. When they returned to South Africa, “the moment he landed he said he was leaving.” Eight months later, Le Roux departed for the UK. At the airport, his bags proved too heavy to check. He ditched his clothes and boarded the plane with a suitcase full of programming books.

Three

Once Le Roux left South Africa, his life became peripatetic. He moved from the UK to the U.S., where he lived in Virginia Beach.** In the mid-1990s, he followed a girlfriend, Michelle, to Australia, then married her and obtained Australian citizenship. At this point in Le Roux’s story, Lulu’s account began to intersect with the faint digital trail I’d already stumbled across.

In an archive of old message boards from the 1990s, I had encountered a prolific and often abusive user from Australia posting under the name Paul Le Roux. In forums like aus.general and alt.religion.kibology (named after a parody religion—it’s a long story), he was often angry and sarcastic, writing extreme or offensive screeds in an attempt to rile up other users. He was, in other words, a troll: the kind of person you might find on Reddit or in a newspaper’s comment sections, getting high off the reactions of fellow posters to his deliberately provocative opinions.

Le Roux was a harsh critic of his adopted homeland. (I’m reproducing all messages verbatim, including errors, here.) “All of Australia could disappear into the Pacific and the only difference it would make to the World,” he wrote in a typical post, “is the Americans would have one less pussy country to protect.”

“As I recall, the genetic effects of human inbreding are not as desastrous as those of breding with animals,” Le Roux went on. “A lesson Australians have never learned.”

People who later worked for Le Roux, at his call centers and other businesses, had told me he was often openly racist. But it was still surprising to see the level of vitriol that Le Roux would attach to his real name. “People like you should be rounded up, castrated, then shot,” he wrote in response to someone who accused him of racism for asserting that Asians should be “screened out” of the country “for DNA defects.” He continued, “Whats more your sperm could be used to create the ultimate germ weapon. Simply impregnate a countries woman, and within 20 years, you will have a race of ‘people’, which by all accounts, are capable only of collecting the dole.”

Like much trolling on the Internet, Le Roux’s provocations worked. His posts so outraged the boards he was posting on that someone even changed their handle to fuck@you.paul. After stirring the board into a rage, Le Roux would declare that his correspondents had fallen for his ploy. “Firstly let me say that Australians are easy to provoke, anyone says your country sucks and a whole bunch of you diggers jump up to defend it -Pathetic! Your postings (including 2 death threats, numerous flames, and one guy who swears he has my address & phone number) have provided me with hours of amusement.”

In a coup de grace, Le Roux penned a 30-part post on aus.general in which he laid out the “Advantages” and “Disadvantages” of Australia as a nation. He made a point to note that, “I am ZIMBABWEAN. I left Zimbabwe in 1984, and have since lived in several countries including the U.S & U.K.” The “Disadvantages” column included “Internet access is far to expensive,” “pornography laws in Australia are backward,” “banks report on everything you do,” and “movies are about 6 months behind the U.S.”

“Drug laws are primitive compared with Europe,” he wrote in closing. “The way to combat drugs is in fact to legalise them.”

**In reporting the story further for The Mastermind book, I discovered that Le Roux had also spent a small amount of time in Seattle, working remotely for the same UK software company. 

Poring through these message boards was like the game Concentration. I would find one clue, stash it away, and hope to turn over another that matched it later on. Early in the process, I noticed that Paul Le Roux used four different email addresses in his posts. But two of them traced predominantly not to his trollish screeds but to highly technical encryption discussions on other boards. One of the emails, pleroux@swprofessionals.com, was connected to a software company called SW Professionals. That same address turned up in the documentation for the encryption software E4M, hosted on the now defunct website E4M.net. That site, in turn, was registered to another of the message-board emails, paulca@rocketmail.com, and to a company called World Away Pty.

In 1995, World Away’s corporate filing showed a Sydney address for Le Roux; it was one of the stranger coincidences of my research, since I was living just a few miles away from him at that time. More importantly, on the next page, the owner of World Away was listed as Paul Calder Le Roux, born in Zimbabwe on December 24, 1972.

Confident in the connection between the two Le Roux’s, I burrowed into the world of encryption. Le Roux, it seemed, had started building E4M—Encryption for the Masses—in 1997. It followed that a talented young man so absorbed with the challenges of code, one who had gotten himself into trouble with law enforcement in the past, would tackle a problem as technically knotty as digital privacy. Le Roux’s software allowed users to encrypt their entire hard drives—and to conceal the existence of encrypted files, so that prying eyes wouldn’t even know they were there. After two years of development, he released it to the world with a post to the alt.security.scramdisk board. According to his own account, the software was written “from scratch,” and “thousands of hours went into its development and testing.”

On the website for E4M, Le Roux posted a manifesto. “The battle for privacy has long since been lost in the real world. As more and more human activity becomes computerised, governments are scrambling to preserve and extend their powers,” he wrote. “Strong Encryption is the mechanism with which to combat these intrusions, preserve your rights, and guarantee your freedoms into the information age and beyond.”

Four

In the spirit of the burgeoning open-source software movement in the late 1990s, Le Roux released E4M for free and made the code available for other people to improve. With no income from his two years of labor, he was struggling financially. His marriage fell apart—violently, both Lulu and a colleague of Le Roux’s told me, although it wasn’t clear what that violence entailed. According to Australian records, the couple divorced in Brisbane in 1999. Le Roux relocated first to Hong Kong, then to Rotterdam, in the Netherlands. He married a Dutch citizen named Lilian Cheung Yuen Pui, and they had a child.

In 2000, Le Roux launched SW Professionals, his software-development company, nominally based back in South Africa. Its motto was Excellence in Offshore Programming; its website claimed that the company had six employees. “I worked with him about six months,” his cousin Heath Jordaan told me after I found his name on an old staff page for the site. Le Roux, he said, was rarely in South Africa. “I think I saw him for about a week or so that entire time.”

One of Le Roux’s clients was an Italian telecommunications engineer named Wilfried Hafner, who had corresponded with Le Roux for several years about his encryption software. Hafner had founded a company to create a commercial encryption product that would combine some of the elements of E4M with another piece of software, Scramdisk. The new company would be called SecurStar, and its product DriveCrypt. Hafner hired Le Roux to build DriveCrypt’s underlying engine.

When I spoke to Hafner on the phone recently, he recalled that Le Roux was desperate for money at the time. He drove a beat-up car and worked out of a Rotterdam apartment small enough that, on the phone, Hafner could often hear a baby crying in the background. At the time, Hafner lived in the south of France, and he said that Le Roux openly coveted the kind of success that he imagined led to such a home. “He saw that these were rich places, and this was his dream,” Hafner told me. “He said, ‘I am ambitious, I want to have all this.’”

Both Hafner and Shaun Hollingworth, the inventor of Scramdisk, who still works for SecurStar today, told me that Le Roux was a gifted programmer. “He was always very smart,” Hafner said. “He came also with some, how do you say, interesting, innovative ideas. But at the same time, I felt he was a little bit… disingenuous.”

I asked him what he meant, and Hafner told me that in the middle of the development work for DriveCrypt, he discovered that Le Roux was still working on E4M and had incorporated some of his work for SecurStar into his personal project. Hafner was furious. Because E4M was an open-source product, the source code that Hafner had personally funded, he claimed, could now be used by anyone to develop an encryption product of their own. He confronted Le Roux, who he says apologized and asserted that it was all a mix-up. “He was very humble,” Hafner says. But the damage was done, and Hafner terminated Le Roux’s contract.

The two reconciled personally, however, and stayed in touch. Hafner told me that Le Roux was also building a gaming engine for an online casino that he planned to launch in Canada and Romania. To do so, he needed to learn a new programming language. “In one week, he was better than most of the programmers I know that program in that language,” Hafner says. “I know that in the casino industry there is a lot of money,” he continued. “But Paul is not a marketer. I didn’t see how he could bring in the gamers to play.” Around 2002, Hafner lost touch with Le Roux.

By October of that year, SW Professionals was defunct and Le Roux was openly soliciting for work on the alt.security.scramdisk forum.

Hi Guys, I’m looking for crypto/or other contract programming work, anybody out there have anything available? if your reading this group probably I don’t need any introduction but I can send my CV as needed.

Paul Le Roux.

It was around this same time, Lulu told me, that Le Roux received some news that “shattered his whole world”: He found out he was adopted. Although many family members had known for years, Le Roux’s parents had elected to keep him in the dark about it. But in 2002, Le Roux traveled to Zimbabwe to retrieve a copy of his birth certificate. On the trip, his aunt and uncle pulled him aside to tell him the truth. “It was the ‘unknown’ part that hurt him the most,” said Lulu.

Not long after, Le Roux appeared on another set of message boards, including alt.business.home and misc.entrepreneurs. He seemed to be launching some kind of moneymaking scheme that required opening a company based in the U.S.

WE ARE EUROPEAN BASED PRIVATE INVESTORS LOOKING FOR A U.S CITIZEN OR GREEN CARD HOLDER TO HELP US SETUP A NEW COMPANY BASED OUT OF FLORIDA, WE WILL DO ALL THE PAPER WORK WE NEED YOUR HELP TO COMPLY WITH U.S LAW. BUT WE KNOW NOTHING IN THIS WORLD IS FREE, SO WE WILL PAY YOU UP TO $500 TO HELP US. PLEASE ONLY GENUINE PEOPLE. NO TIME WASTERS.

In 2004, a group of anonymous developers did exactly what Hafner had feared: They released a new and powerful, free file-encryption program, called TrueCrypt, built on the code for E4M. “TrueCrypt is based on (and might be considered a sequel to)” E4M, a release announcement stated. The program combined security and convenience, giving users the ability to strongly encrypt files or entire disk drives while continuing to work with those files as they would a regular file on their computer.

Hafner and his SecurStar colleagues suspected that Le Roux was part of the TrueCrypt collective but couldn’t prove it. Indeed, even today the question of who launched the software remains unanswered. “The origin of TrueCrypt has always been very mysterious,” says Matthew Green, a computer-science professor at the Johns Hopkins Information Security Institute and an expert on TrueCrypt who led a security audit of the software in 2014. “It was written by anonymous folks; it could have been Paul Le Roux writing under an assumed name, or it could have been someone completely different.”

Hafner found an email address associated with the TrueCrypt programmers and sent a cease-and-desist letter, arguing that the software was based on stolen code. The developers did briefly stop additional development but soon started up again. The response of the free-software community could be summed up in an anonymous message-board response to Hafner’s demand: “FUCK YOU, SecurStar—we’ve got it already!”

For the next decade, that mysterious group of anonymous programmers maintained TrueCrypt, with funding from some equally opaque source. TrueCrypt came to be known as the most powerful and reliable encryption solution available. “They improved it, even did quite impressive work on top of it,” says Hafner, whose business was forced to compete with a free product. “Nevertheless, it’s built on our engine.”

In response to the controversy, in June 2004, Le Roux returned to the alt.security.scramdisk forum and posted a note defending his E4M work, adding that when it came to the controversy over TrueCrypt and E4M, “the pure speculation here (often stated as fact) is damaging and in some cases libelous.” After that post, he disappeared from the message boards for good.

Five

Le Roux’s departure from the encryption world, at least under his own name, coincided with his entry into the Internet-pharmacy business. Lulu told me that Le Roux said he decided to switch to online pill selling after a lawyer in Costa Rica—where much of the online casino industry was based—suggested that he go into pharmacies instead. In 2005, Le Roux surfaced in Israeli documents registering IBS Systems, one of the companies that would evolve into the customer-service arm of his prescription-drug empire. Le Roux is listed at an address in Rotterdam, alongside a scanned image of his Australian passport. He had linked up with two Israeli brothers, Binyamin and Tal—according to one former employee, they met in an online forum—to create what would eventually be known in Israel as CSWW and as RX Limited to the U.S. government.

Before long he started on a project requiring advanced technical know-how: a seamless digital pipeline from American doctors to pharmacists to eager drug consumers. RX Limited played on human greed and vulnerability to recruit doctors and pharmacists, like Charles Schultz in Oshkosh, Wisconsin, into the network. But the business thrived on Le Roux’s complex infrastructure, which was able to process tens of thousands of customer questionnaires each week, direct them to doctors to write prescriptions, and then on to pharmacists to ship them.

By 2007, Le Roux had moved his family to Manila, operating out of a house in the upscale gated community of Dasmarinias. From my reconstruction of RX Limited’s digital machinations, I could see that he had evolved his technical acumen to suit his new business enterprises. But beyond that, I wanted to know what the flesh-and-blood Le Roux was like as his empire grew.

“The Fat Man. That’s what we called him.” This was the first thing Gil (not his real name***), one of Paul Le Roux’s former associates, told me when I met him in Manila last December. It was a sunny day, and we sat down outside a Starbucks that he had selected in Makati City, Manila’s upscale business district. He had lit a cigarette and dropped the pack on the table, ready to procure another one. “People are still really scared, because there is a strong belief that there are operations still going on,” he told me. “Money talks in this country. For 5,000 pesos”—around $100—“you could have someone taken out.”

As his nickname implied, Le Roux’s appearance by this point was striking; in the early 2000s, he had been putting on weight, ballooning to 240 or 260 pounds, by Gil’s estimate. “He had a giant head,” another former associate told me when I asked him to describe Le Roux. His hair, generally kept somewhere between a buzz and a banker’s haircut, had by his forties gone from black to silver, framing a set of plump cheeks and small, slightly flared nostrils. Le Roux’s size could be imposing, although opinions varied as to whether he was truly physically intimidating. Many seemed to view him as a stereotypical nerd, a doughy loner with an adept technical mind but few social graces. “He was not a soft, gentle person,” one former associate said.

Like the more magnetic young man Lulu recalled from his childhood, however, Le Roux was not without charm, particularly when it came to newly hired employees, to whom he projected an easygoing image of power and success. “He was the nicest guy when you first met him,” Gil said. “He was always buying gifts for people. His representation of himself, as far as I am concerned, made him seem more legitimate.”

Those who rose within the ranks of what most just called the Company found Le Roux to have an alluring managerial style: He was receptive to suggestions and sent untested people into situations and responsibilities they never imagined. “He gave you space to maneuver,” said a former high-level Israeli employee of Le Roux’s who met me one afternoon at a mall café in Tel Aviv. “You could come to him with anything; you felt like you had an opportunity to do something you liked and make money doing it. That was before he got all twisted.”

As RX Limited earned hundreds of millions of dollars, Le Roux’s lifestyle changed in some ways but remained the same in others. He became known for bragging  graphically to associates about his extramarital conquests. “He lived in expensive houses in exclusive areas, but he didn’t live extravagantly,” Gil said. “He would travel in flip-flops, shorts, just like a bum. Anywhere, he would look like that.”  Lulu recalled that Le Roux told him that RX Limited was bringing  in four or five million a month, but it didn’t show. “He was as tight as they come,” Lulu said. “I assume he was just hoarding it.”

By 2008, the Le Roux who once gleefully posted online under his own name was gone, replaced by a man obsessed with secrecy and holding a pocketful of identities. His activities were spread across dozens of shell companies registered all over the world, with names like Ajax Technology, Cycom, GX Port, and Southern Ace. Le Roux often used the identity John Bernard Bowlins and had a fake Zimbabwean birth certificate and passport to back it up. Some people called him Benny, others went with Boss or even Paul, if they knew his name at all. Le Roux had another fake Zimbabwean birth certificate for a Johan William Smit—it was an ironic alias, Lulu told me, because it’s a popular name in Afrikaans, the language Le Roux dropped out of school rather than learn. Another birth certificate listed his identity as William Vaughn.

“When I corresponded with him in the beginning, he used the name Alexander,” a South African who worked for one of his companies told me. “When I met him, he introduced himself as John. I only found out after more than a year that he is actually Paul Calder Le Roux. But then again, we all used pseudonyms in the Philippines.”

In his first email, Lulu had told me that Le Roux possessed a diplomatic passport from the Democratic Republic of the Congo, a document that helped him avoid customs. Lulu forwarded me a copy of it; the passport was issued in Le Roux’s own name.

Wealth seemed to begin to amplify Le Roux’s natural impulses—greed, impatience, a sense of superiority. Lulu told me that he thought that in 2008 or 2009, something in Le Roux snapped. “He changed at that point,” he said. “I think the money got to him. I personally saw $100 million in his office in Makati. Cash, bud. It was fucking ridiculous. It was in wicker baskets lined up on the side of the wall in his office.” One image in particular stuck with him: He remembered that the $100 U.S. bills were each stamped with a pink rabbit.

Like the Silicon Valley entrepreneur who sells a company for $100 million, only to start another one in hopes that it will sell for a billion, Le Roux made the pursuit of more money, and more power, an end in and of itself. But the kid who had once locked himself in his bedroom, losing himself in code, had gone as far as his technical skills could take him. He wanted to be a different kind of businessman, a lord of the real underworld, not just the virtual one. “He made money on the pharmacies, and then he decided that he wanted to make more money, fast,” the Israeli associate told me. Le Roux wanted to diversify, to be bigger, he said. “The only way to do that was illegal. He was living inside a movie, you could almost say. He always had a dark side, it just developed more with money.”

***For The Mastermind book, Gil agreed to go on the record under his real name, but I am leaving him anonymous here to reflect the original telling of the story. 

Sometime in 2008, Wilfried Hafner logged into his long-dormant chat account and noticed Le Roux’s handle was still active. He messaged Le Roux and the two exchanged greetings and caught up. Hafner mentioned that he was raising money for a new phone-encryption software project called PhoneCrypt. Le Roux remarked that he was now a wealthy man and would consider investing if Hafner sent along his business plan. Remembering how little money Le Roux had had back in the early 2000s, “the picture did not match,” Hafner said. “I didn’t take it seriously.”

“It’s a pity I didn’t believe it,” Hafner said, before stopping himself. “On the other hand, I could have gotten wrapped up in these stories.”

Six

In the years since Le Roux disappeared from the encryption community, the ideas that drove him to develop E4M were slow to penetrate the public consciousness. As more of our lives became digitized, governments began peering into them. TrueCrypt, E4M’s progeny, had become one of the most popular disk-encryption programs, used by tens of millions of people. Yet the significance of encryption remained largely the province of privacy enthusiasts and libertarian hackers.

All of that was about to change. In November 2012, a man with the online handle Cincinnatus decided to throw a party in Hawaii. The idea arose out of an email exchange with Runa Sandvik, a developer and expert on the online software Tor, which allows its users to mask the physical location of their computers on the Internet. After she gave a Tor tutorial on Reddit, Cincinnatus sent Sandvik an encrypted message.

Cincinnatus told Sandvik that he lived in Hawaii. Sandvik mentioned that she would be there on vacation the following month and could give a talk on Tor. Cincinnatus suggested they host a “cryptoparty,” a phenomenon that had arisen around that time among technology- and privacy-conscious activists. Such events were a chance to “teach beginners how to use the commonly available tools that tap into the incredibly powerful technology of cryptography,” as Cincinnatus’s invitation would explain. The date was set for December 11. “I never imagined,” Sandvik later wrote in an account of the events published on Forbes.com, “that the innocuous emails we exchanged might one day be of interest to the U.S. Government.”

Unbeknownst to Sandvik, her fellow party planner was hatching a much more elaborate education scheme. Four days after he contacted Sandvik, Cincinnatus sent an email to the journalist Glenn Greenwald. “The security of people’s communications is very important to me,” he wrote. In a series of emails, he suggested that Greenwald set up an encrypted means by which sources could contact him.

Cincinnatus organized the cryptoparty at a hacker space called HiCapacity, located in the back of a furniture store in Honolulu. The event was well attended, with “a solid mix of age groups and genders,” as Cincinnatus later recounted. When Sandvik arrived around 6 p.m., Cincinnatus introduced himself as Ed and told her that he worked at the computer-hardware company Dell. Ed kicked off the evening by welcoming the attendees, then invited Sandvik to give her presentation on Tor.

When she was finished, Ed pulled out his laptop, plugged it into the projector, and began his own instructional talk about TrueCrypt. In Ed’s presentation, Sandvik later wrote, he “pointed out that while the only known name associated with TrueCrypt is someone in the Czech Republic, TrueCrypt is one of the best open-source solutions available.”

On a website for the party, Cincinnatus posted an “after-action report.” “I’m making a note here,” he summarized, “huge success.” (As multiple correspondents have informed me post-publication, Snowden was referencing a meme from the video game Portal. )

Six months later, in June 2013, Greenwald and filmmaker Laura Poitras published the first of a still-ongoing series of articles that grew out of their contact with Cincinnatus. In time they revealed that his full name was Edward Snowden, that he had worked in various capacities at the National Security Agency, and that he had downloaded and handed over a trove of documents from the NSA in an effort to blow the whistle on what he believed were egregious privacy encroachments by the U.S. government. Among them was a document revealing that TrueCrypt was one of a small number of encryption programs that had withstood the NSA’s efforts to crack it.

What Snowden and the rest of the world wouldn’t know for another two years was that Paul Le Roux, the man whose code formed the foundation of True Crypt, was at that very moment in the custody of the U.S. government. Le Roux was in a bind, facing the full force of a U.S. federal prosecution for any number of his extraordinary array of crimes. The only way out was to spill his secrets.

The Mastermind Episode 2: ‘I’m Your Boss Now’

When you don’t know who your boss really is, a dream job can turn into a nightmare.

By Evan Ratliff

One morning in early 2009, a 26-year-old manager of an Israeli customer-relations call center named Moran Oz found himself treading water in a hail of bullets. A moment before, he’d been sitting on the deck of a small yacht, cruising just out of sight of the Philippine shoreline. Then he was in the water, the boat was pulling back around, and the three men he had thought were his boss’s business partners were standing above him. Two of them were armed, and one began firing into the ocean close to Oz. “That was for the sharks,” one said when the shooting finally stopped. “The next time will be for you.”

The man was holding a satellite phone. “You are stealing from Paul,” he said. “You need to tell us where you put the money.”

Oz felt disembodied and panicked for time. Whatever they thought he’d done, he told them, it was all a mistake. “If I’d done anything,” he said, “I would’ve told Paul.”

When I first heard the outlines of this story, from an attorney in Minneapolis last fall, I initially had a hard time believing it. Later I would learn of incidents even more difficult to comprehend, but at the time it sounded too much like something out of a movie. Then I remembered a couple of things that Joseph “Rambo” Hunter, one of Paul Le Roux’s enforcers, had once said in a conversation recorded by the DEA. “This is real stuff,” he told a new member of an assassination team. “You see James Bond in the movie and you’re saying, ‘Oh, I can do that.’ Well, you’re gonna do it now.”

Then, amid a string of boasts about intimidating and killing people who stole from Paul Le Roux, Hunter said: “We ah… not kidnapped a guy, but we conned him to come with us. We put him in the ocean, shot at him.”

As I tracked down former employees of Paul Le Roux—in Israel and the U.S., the Philippines and Hong Kong and Zimbabwe—many of their stories followed a similar arc. At one moment they’re involved in workaday, seemingly legitimate tasks. Some never even heard the name Paul Le Roux; others thought of him as a brilliant but eccentric and occasionally obnoxious boss. Then something happens—a message arrives, a rumor reaches their ears, they’re told to meet three strangers at a marina—and they realize they’re involved in a sinister world beyond their comprehension. At that point, they face a moral and practical question of how to proceed. For some, how they confront that moment will mean the difference between freedom and confinement. For a few, it will be the difference between life and death.

As one former associate of Le Roux’s, and friend of Moran Oz’s, told me as we sat at a bustling café inside a mall in Tel Aviv, the majority of his colleagues were “good people, educated about the difference between good and bad.” We’d been talking for an hour about his experience with Le Roux, and for the first time he seemed genuinely dismayed. “That’s what is really sad about this,” he said, “good people getting sucked into something just because they felt threatened.”

To understand how Moran Oz ended up in the ocean off the Philippine coast, I traveled to Tel Aviv to talk with his friends and colleagues—both inside Le Roux’s organization and out—along with the accountants and lawyers who had represented him. Many had spoken to Oz in detail about his experience and agreed to talk to me on the condition that I not use their names, out of fear that by revealing their identities they could end up in a similar predicament as Oz.

Such was the case with Oz’s childhood friend, whom I met on a beautiful afternoon in February, in an office park at the center of Tel Aviv’s vibrant startup scene. He was as eager to share his detailed recollections of Oz as he was desperate to make sure that he didn’t come to share his friend’s fate.

Moran Oz grew up in Jerusalem. He was the sort of kid everyone wants to be around, the friend told me: “The kind of guy who could miss class and then waltz in and get an A.” In February 2005, Oz had just graduated from high school and completed his compulsory service in the Israeli army. He was visiting an uncle in New York, pondering what to do next with his life—go to school? start a business of his own?—when another friend called to say that his brother-in-law had launched a company in Israel and was looking to hire. The only requirements were a good command of English and a basic understanding of computers. Oz flew home and took the job.

The man who hired him was an Israeli I’ll call Binyamin. He’d started the business with his brother, Tal, who lived in Los Angeles, even though their company—Beit Oridan, it was called—was based in Jerusalem. It was the kind of business that was thriving in Israel at the time, benefiting from the country’s sound technological infrastructure and widely English-speaking population. Generally known as call centers—although much of their work happened over email—companies like Beit Oridan served as the customer-service arms of larger organizations based outside Israel, often serving customers in the United States. In this case, the larger organization was a network of websites that went by names like RX Limited and Alpha-Net, and sold prescription drugs to American consumers over the Internet.

On those sites, customers filled out a questionnaire asking about their medical history and symptoms, ordered their medication of choice, then paid by credit card. The questionnaire was transferred to an American doctor, previously recruited by the company, who would write a prescription based on the answers. The prescription would then be transferred to a pharmacist—also recruited by RX Limited and located in the U.S.—who would use a FedEx account supplied by the company to ship the drugs to the customer. Both the doctor and the pharmacist received a fee for each order.

For Israelis like Oz, whose medical needs were met by the government, RX Limited seemed like a reasonable stopgap for America’s poor health care system. As one former Beit Oridan employee told me, their belief was that, in America, “if you work for a company and you are fired after 40 years, you cannot go to a doctor and get the prescription for your heart pills. So what we did was provide the doctor and the pharmacy.”

Oz also had the impression that the RX Limited network was compliant with prescription-drug laws in the U.S. For instance, a database held the order history for every customer and tracked the dates and amounts of their last purchases. If a new order showed up more quickly than a drug should have been consumed, the customer couldn’t get a refill until the appropriate amount of time had elapsed.

Occasionally, the company ran into what Oz and his colleagues thought of as regulatory hitches in the U.S. If a prescription could no longer be mailed from a certain state, the system removed it. If the rules around a medication changed, the system seemed to change accordingly. Occasionally, Oz would hear about American affiliates being inspected by the local pharmacy board; they would go offline for a few days, then reappear in the system.

Oz’s job, however, didn’t require any knowledge of pharmaceuticals, nor of the technological infrastructure behind RX Limited. He arrived each morning at Beit Oridan’s office, quickly reviewed the prescriptions uploaded by doctors in the U.S., then clicked a few buttons to send them to one of RX Limited’s participating pharmacies, allocating orders according to each store’s daily capacities. The rest of the Israeli staff was responsible for communicating with doctors and pharmacists, and for customer support: dealing with password problems, lost shipments, expired credit cards, and incomplete questionnaires rejected by doctors.

In 2005, when Oz began, the company had eight American pharmacies operating in the system, taking 8,000 orders a week. But it was growing quickly, and after a few months the number of employees doubled. Among the new hires was a man named Alon Berkman, whose primary responsibility, at least at first, was to provide accounting support for the American pharmacists and doctors. Beit Oridan’s employees were instructed to adopt American-sounding names and to say that they were located in Utah. Oz’s handle was Ron Martin; Berkman’s was Allen Berkman.

One of the people on the other end of those communications was a 74-year-old pharmacist in Oshkosh, Wisconsin, named Charles Schultz. Schultz had been in the business for a long time; following a stint as an Army medic during the Korean War, he’d opened his first pharmacy in 1964 and ran it with his wife, Jeanne. After a few false starts, they built Schultz Pharmacy into an established business, set on a quaint street in downtown Oshkosh, hugging the western shore of Lake Winnebago. In the 1980s, he bought a pharmacy called Medicine Mart in Monroe, a town 100 miles south of Oshkosh. For decades, Schultz was a respected businessman in the two communities, a good boss and tireless worker.

In the summer of 2006, Schultz received a fax from a company he’d never heard of, Alpha-Net Trading, with an address in Costa Mesa, California. The letter offered him an enticing business opportunity: Alpha-Net could augment Schultz’s in-store sales with online prescriptions, without any investment from him. His role couldn’t have been simpler. If he became an Alpha-Net affiliate, all he would have to do was log in to the company’s system, fill prescriptions written by American doctors, and ship them using Alpha-Net’s FedEx account. He’d then be reimbursed by bank transfer for the wholesale cost of the prescription, plus $3.50 for each one filled.

The offer arrived at a particularly vulnerable time for Schultz. His business had been in decline for a decade or so as big-box drugstore chains began to crowd out the little guys. His family, meanwhile, was beleaguered by health problems. His son suffered from a neurological disorder that required nearly full-time care. And Schultz himself had been struck by a series of small heart attacks, brought on in part by the stress of keeping his business afloat and the long hours spent shuttling between the Oshkosh and Monroe stores.

At first, Schultz ignored the offer. Then he conducted a bit of online research to determine if it was real. Finally, he got in touch with the company’s recruiter. Schultz said he had doubts about the ethics of the operation. But the recruiter quickly dispelled them, sending Schultz copies of the licenses of the physicians writing the prescriptions and explaining that Alpha-Net didn’t sell controlled substances. “If an online pharmacy is asking you to ship controlled drugs, you better put your fees away for a lawyer,” Alpha-Net’s reps were trained to tell prospective pharmacists, “because you are going to jail.”

Alpha-Net and its dozens of affiliate websites offered a range of prescription medications—everything from Propecia, the hair-loss drug, to generic forms of Viagra. But its three biggest sellers were Ultram, Soma, and Fioricet. Ultram was the brand-name version of an opioid painkiller called tramadol. Soma, also known as carisoprodol, was a muscle relaxant often prescribed for back problems. And Fioricet, recommended for tension headaches, was often prescribed to treat migraines. To further put his mind at ease, Alpha-Net gave Schultz the number of a former DEA agent in Florida, who assured him that none of the medicines he would be shipping would cause problems.

In the summer of 2006, Schultz signed up both of his pharmacies, and before long he was filling thousands of prescriptions a month. His bank account received increasingly frequent wire transfers from Hong Kong in amounts that grew to the tens of thousands of dollars. Someone at the top was clearly making tremendous amounts of money selling online prescriptions. Who that might be, Schultz didn’t have the first idea. “Alpha-Net said that its operation was legal and legitimate,” Schultz would later explain in a sentencing memo that his attorney filed in federal court in Green Bay, after the DEA had shown up at Schultz’s door, altering his life forever. “I wanted to believe them.”

Binyamin and Tal told their employees that they had a third, silent partner in the business—a programmer Tal had met after posting an ad in an online forum. That programmer handled the infrastructure of the company, part of which he outsourced to two contractors in Romania. The day-to-day operations, though, and the future plans for the company, were determined by the brothers. In July 2006, however, Oz returned from a vacation to discover that Binyamin had been ousted from the business. No reason was given for the falling out between the brothers, but from then on Tal would be in charge, running the operation predominantly from the U.S.

After Binyamin’s departure, the business continued to grow. Oz and Berkman recruited friends to work with them, extolling the flexible shifts and good pay, which was generally about 15 percent higher than other call-center jobs in Israel.

Then, one afternoon in the fall of 2007, an instant message popped up on Moran Oz’s computer screen. “I’m your boss now,” wrote someone calling himself Paul Le Roux, a name Moran had never heard before. There was no explanation, no pleasantries, simply a statement that he’d been in charge with Tal from the beginning, but now Tal was out. “From now on,” Le Roux said, “you report to me.”

Oz called Tal, who quickly explained that Le Roux was a South African programmer living in the Philippines. Tal was stepping aside for this formerly silent partner, he said. When Oz asked him why, he said only that he had been working too hard and wanted to see his daughters grow up.

At first the new boss didn’t alter the atmosphere in Jerusalem. The business was the same, the customer-service concerns unchanged. The company kept growing, retaining its high pay and decent hours. Oz’s and Berkman’s responsibilities began to expand.

As for Paul Le Roux, he always claimed to be too busy to travel to Israel and conducted almost all his business over the company’s chat system, in a gruff style utterly devoid of small talk. He didn’t joke, and he never asked questions about the lives of his employees or offered up any information regarding his own. He was more concerned about information security than Binyamin or Tal ever had been; he insisted that Oz and Berkman encrypt their hard drives, at first with a program called E4M (which stood for Encryption for the Masses), and then with one called TrueCrypt. But otherwise, as far as Oz was concerned, a boss was a boss.

A few months later, Le Roux declared that he wanted to meet Oz and Berkman in person, in Manila. Oz’s childhood friend told me that at first, the new jet-setting aspect of the business made Oz’s position sound “like a dream job.” The pair flew business class to Manila via Hong Kong. A driver fetched them from the airport and deposited them at a luxury condo located next to a synagogue.

They met Le Roux for a series of dinner meetings at the Hard Rock Café, located in a mall in Makati, the upscale shopping and business district in the center of Manila. “These Jews can’t eat any of this!” Le Roux joked with the waitress. “Just get them some chips.” I learned about those meetings, and others that would come later, from former employees who worked closely with Le Roux. They would speak with me only on the condition of anonymity, concerned that discussing Le Roux might come back to haunt them.

In the fall of 2008, Le Roux brought Oz and Berkman back to Manila to tell them he would be opening a new call center in Tel Aviv, which he wanted them to staff and oversee. “Money is not an issue,” he told them.

Shortly after that meeting, Le Roux sent an advance man, a British citizen named Robert McGowan, to Israel to register the new company—called Customer Service Worldwide, or CSWW—under McGowan’s name. Beit Oridan, which had formerly been renamed IBS Systems, became SCSM. (The company was meant to be called Customer Service Management, one employee told me, but the name was taken. So a meaningless “S” was tacked onto the front.) When I recently got a hold of the government’s official records on the various iterations of the companies, I found photocopies of not only McGowan’s British passport but Le Roux’s Australian one. It seemed curious that a man so concerned with secrecy would leave such a blatant clue in the paper trail of a possibly illegal enterprise.

CSWW opened in 2009, housed in an 11-floor building not far from the government center of Tel Aviv. The Israeli national government’s Money-Laundering Prohibition Authority was located on another floor of the building. Under the new system, CSWW would handle customer service in Tel Aviv, while SCSM would manage accounting and company infrastructure from Jerusalem. Neither CSWW nor SCSM made any money themselves. To cover the two companies’ expenses, Le Roux was soon wiring $300,000 a month from a bank in Hong Kong.

None of that was unusual in the call-center industry, according to Dov Weinstein, an accountant I met with in Tel Aviv. Each month, he said, Oz made a list of the company’s expenses, and Le Roux sent a payment to cover them. Oz had brought in Weinstein, an experienced CPA and a friend of his father’s since Oz was a child, to make sure the company’s books were being done correctly. “They mentioned all the time that there is a South African guy,” Weinstein told me. “If you ask me, I think that maybe they did not trust him.”

As RX Limited grew, Le Roux opened call centers beyond Israel. The company’s volume of orders created an endless stream of customer-service requests, and RX Limited adopted aggressive email marketing techniques to recruit more. In the Philippines, Le Roux’s call centers were given names like Dial Magic and Global I-Net Bridge. (Eventually he added one in India as well.) To fill the managerial positions, he turned to Oz and Berkman. Oz’s childhood friend told me, “His boss was always asking him to recruit people, Israelis, to go to the Philippines.”

In one sense, Le Roux’s trust of Israelis seemed odd. Among employees he was widely known for his openly racist views. “For Paul, everyone was a ‘nigger.’ I was a ‘white nigger,’” one call-center manager told me. “Or a ‘floppy,’ which is a South African term for nigger.” But Le Roux reserved special vitriol for the people in whose midst he lived, “calling Filipinos monkeys—to their faces.”

Israelis seemed to be exempt from Le Roux’s personal animus. “I don’t think he particularly liked Jews,” the call-center manager said. They were simply the “cheapest, honest, smartest labor that he could find.”

Eventually a kind of pipeline developed, with one Israeli following another to Manila. In January, I tracked down one of those transplants, Yehuda Ben-Dor, an Israeli-American whose LinkedIn profile suggested that he had been high up in the Philippine version of CSWW. Unlike many former employees, Ben-Dor—who now runs his own call center in the Philippines—told me by phone that he’d be happy to talk on the record. “My understanding was that this was all legal,” he said. “There was nothing fishy about it.”

Ben-Dor was living in Tel Aviv, he told me, when he answered a local ad for work in the call center there. He took the job and quickly moved up to manager. In 2010, his boss asked if he wanted to transfer to the Philippines. “I wasn’t the first to come over here. There were many others before me who had been coming over to man them,” Ben-Dor told me, referring to the call centers. “The thing with Paul’s company was that the attrition rate was pretty high, people come and go, and he was always looking for new people. I was the next guy, so to speak. I didn’t know anything about the Philippines at that time.”

Within a few days of arriving in Manila, and never having met Le Roux in person, Ben-Dor found himself overseeing ten call centers with more than 1,000 employees. “They didn’t tell me anything about the job,” he said, “basically just that they needed Americans or English speakers to train the Filipinos.”

Le Roux provided apartments to the Israeli transplants. “He had a lot of condos,” Ben-Dor said. “He moved people around in them for some reason, like musical chairs. When I was first here, I was working in a house in Taguig, and then he said, ‘I need you to move over to the Fort’”—a financial district in Manila also known as Bonifacio Global City—“so I moved over to a condo in Global City. Then he said, ‘OK, I need that one, so I need you to move to another one.’ I was like, why does he have all these empty condos?”

Le Roux was as much a mystery to employees in the Philippines as he was to those back in Israel. He owned a pub called Sid’s in Manila, a dumpy expat hangout, but was rarely seen there. “I don’t believe that he had a social life,” one former call-center manager told me. “It’s not like he would go to the country club or meet other expats of his age. He was a workaholic, from what I understood, 18 to 19 hours a day. At no point did I ever meet anybody that was introduced as his friend.”

Le Roux paid Israel-level salaries in the much cheaper environs of Manila, offering a standard of living that was hard for recruits to turn down. And he seemed willing to spend on quality employees. “He would start very, very low,” the manager told me, “but you could negotiate with him easily. He had this intimidating physical presence, so people would be afraid to ask for more. But when you understood that money meant nothing to him, then I thought, Why not ask for a significant pay raise? The numbers, the money, wasn’t important.”

Ben-Dor told me that in nearly two years working for Le Roux, he saw his boss only a handful of times. Once “he called me up and asked me to just come on over to his condo,” Ben-Dor said. Ben-Dor described the apartment, a massive, empty space, with Le Roux sitting alone at a desk—the only piece of furniture there. He was flanked by stacks of servers, Ben-Dor said, like he was at the helm of some sort of command center. Le Roux dispensed with greetings.

“How’s it going?” Le Roux asked.

“It’s going good,” Ben-Dor told him. He began rattling off numbers, eager to prove that the call centers were performing well, but Le Roux cut him off.

“Well, let me know if you need anything,” he said.

The meeting with the boss he’d barely met, who had moved him to the Philippines and housed him and placed him in charge of over 1,000 people, was over in five minutes. “You called me all the way over here to tell me that?”

“Yeah,” Le Roux told him. “I just wanted to meet you.”

For Charles Schultz, the pharmacist in Oshkosh, the relationship with Alpha-Net was everything they’d promised. The system provided him with a regular stream of prescriptions, written by doctors all over the country. Alpha-Net representatives, whom he knew by names like Mike Gilmore and Will Morris, straightened out any problems when they arose and stayed in touch by phone and email. On one day in July 2010, Schultz Pharmacy filled and shipped 973 prescriptions. On another, in December 2011: 575. Schultz would later admit that he knew that the volume of prescriptions coming his way strongly implied that doctors weren’t examining the patient questionnaires thoroughly. But he never heard from any authorities, and his business was finally on level footing.

By the end of 2011, Schultz’s two pharmacies had shipped over 700,000 prescriptions. Alpha-Net had wired over $27 million from various accounts in Hong Kong to Schultz’s bank. Most of the money was to cover the wholesale cost of the drugs, but $3.3 million came from the per-prescription fee that Schultz received, which the company had raised in 2007 from $3.50 to $4.

Among the hundreds of thousands of shipments Schultz sent out, it would take only six of them to unravel his life. A customer in Minnesota placed a half-dozen orders for Soma and Fioricet through five different Alpha-Net-controlled websites between 2007 and 2010. The customer’s questionnaires were handled by four different doctors, whose prescriptions in turn were filled by Schultz Pharmacy and Medicine Mart. That customer was a special agent for the DEA.

The DEA had stumbled into the path of RX Limited almost by accident. In an investigation into a pharmacy in Chicago in 2007, agents had discovered that the business appeared to be shipping large amounts of prescription drugs using a single FedEx account. When they obtained records from FedEx, they found something more astounding: Approximately 100 pharmacies across the country were using that same account number. All of them were predominantly shipping the same three drugs: Fioricet, Ultram, and Soma.

That fall agents from the DEA started making undercover, or “controlled,” buys of prescription drugs on RX Limited–related websites. Helpfully, when each delivery arrived, it came labeled with the doctor who had written the prescription and the pharmacy that had filled it. The websites made sure to emphasize, as a court filing later noted, that they “did not sell controlled substances, that their drugs were dispensed by board certified and/or licensed physicians and/or pharmacies, and that RX’s customers did not need to see a physician in person or have a prior prescription in order to purchase prescription drugs online.”

There were dozens of RX Limited websites from which to make controlled buys, with names like Cheaprxmeds.com, Allpharmmeds.com, Buymedscheap.com, Your-pills.com, and Speedyrx.com. The agents began, in October of 2007, with a site called Acmemeds.com. An agent logged on as a customer, filled out a questionnaire, and ordered 30 tablets of Soma. The prescription was filled by a pharmacy in Monroe, Wisconsin, called Medicine Mart, owned by Charles Schultz.

After the boat incident, people close to Moran Oz told me that his demeanor changed. The childhood friend I spoke to in the office park said that Oz wouldn’t tell him what happened on his trip, only that, speaking of his boss, “I don’t think I should be working with this guy.” The friend tried to persuade Oz to come work with him at a startup, but Oz said he couldn’t. “He was different, like he was shut down,” the friend said. “He was suspicious. We didn’t know of what.”

To Oz, it also seemed that Le Roux was different after that trip. He was always short on social graces, but in the ensuing months he became increasingly vicious, threatening employees when something wasn’t done in the way he’d asked. “Alon better answer the phone or he won’t have a hand to do it with or a tongue to speak,” he once told one of Berkman’s coworkers.

Among the managers at his call centers, there were now constant whispers about the boss. “I heard he was doing human trafficking, he was doing arms trades, he was having people killed. It sounded like a comic book, and I didn’t know what to believe and not to believe,” one former call-center manager in the Philippines told me. “I heard that he had an airplane business where he was making airplane engines and hiring people to fly to other countries to smuggle drugs. It was too surreal to believe that this guy was actually getting away with stuff like this. I didn’t know what of it was credible information. I could only confirm what I knew.”

The more I heard from former employees and associates of Le Roux’s, the more I wondered why they didn’t just walk away. Some did. Another former call-center manager in the Philippines, who met me at a Starbucks in Makati one afternoon, told me that over several years it gradually dawned on him that Le Roux’s primary interest was in pushing his businesses as far into the darkness as possible. “There’s a difference in doing a gray businesses and just being interested in illegal business,” the manager said. When he asked Le Roux why he didn’t build on his growing fortune by expanding his call-center services and selling them to other companies, Le Roux professed not to be interested. The manager decided he wanted out. “I didn’t want to be working for a guy that was more interested in illegal businesses than legal ones,” he told me.

The question of why more people among the dozens who mananged operations for Le Roux didn’t abandon him, once they started to learn troubling facts about him and the business, is one that defense lawyers and prosecutors are grappling with now. The answer for some of them, as Oz’s attorneys explained it to me, was simple: They believed Le Roux would kill them if they did. I heard much of Oz’s story sitting in a conference room one morning last November, in the Minneapolis office of Joe Friedberg. Friedberg and Robert Richman, both prominent local attorneys who specialize in high-profile criminal cases, currently represent Oz. They told me that it wasn’t just Oz who was intimidated by Le Roux. Omer Bezalel, an operations manager at one of the Israeli businesses, had once attempted to leave Le Roux’s employ. “Two guys showed him pictures of his family,” Friedberg said, “and said, ‘You aren’t going to quit.’”

Around 2011, Le Roux began to disappear for long stretches. None of the high-level employees whom I spoke with knew at the time where he was or what he was doing, only that when he resurfaced he would be more threatening than before. “The fact that he was underground was scarier,” the Israeli call-center manager said. “When he was overground you could talk to him. But when he came back it wasn’t reasonable. He was so angry, and the questions he was asking didn’t make sense. He would just explode. Whatever he said, you said, ‘OK, OK,’ and then hoped that he would forget it.”

In 2011, the U.S. government declared distribution of the drug Soma across state lines illegal. It was one of RX Limited’s tentpole pharmaceuticals, and when pharmacies refused to ship it, a third of the company’s business evaporated overnight. Federal prosecutors would later allege that in the four-year period leading up to August 2011, RX Limited had shipped $300 million worth of drugs.

Le Roux decided to close the Tel Aviv office and move all customer service to the Philippines. Oz and Berkman helped unwind the operations, shipping the computers and office furniture to Manila. The process lasted into 2012, when Le Roux announced that he was downsizing the Jerusalem logistics office as well. He told Oz that the company had lost its credit-card-processing service and needed to scale back further.

The transfers that normally came in from Le Roux’s accounts in Hong Kong started arriving from new and strange places. Then they became sporadic, according to Dov Weinstein. Soon the company lacked the funds to pay severance owed to laid-off employees. When Oz complained, Le Roux wired two-thirds of the money and—in a move that seemed to defy his increasingly dark character—pledged to send the rest soon.

Meanwhile, Le Roux designated a new point man in the Philippines for the Israeli companies to communicate with, a Filipino whom Oz and Berkman had never met and knew only by his online handle: Persian Cat.* It struck them as strange; Le Roux had never trusted locals to run any part of the business before. But Oz, already stung from having to lay off most of the company, was desperate to get the remaining severance. He stayed in touch with both the Persian Cat and Le Roux, who kept promising that the money would arrive.

*Later, while researching The Mastermind book, a source indicated to me that “Persian Cat” was a moniker used by Nestor Del Rosario, a former Le Roux call center manager who had also been pulled into other sides of the business, including arms sales to Iran.

In March 2012, DEA agents showed up at Schultz Pharmacy in Oshkosh armed with search warrants. Schultz immediately admitted his involvement and handed over his computers and records. He also agreed to maintain his relationship with his Alpha-Net contacts, and he let the agents record telephone calls. He gave the agents a room to set up in at the pharmacy and served them coffee.

The DEA had in its possession RX Limited’s largest supplier, an 80-year-old pharmacist in Wisconsin. Schultz had little in the way of information about the larger scheme he’d been a part of—some names and phone numbers, emails back and forth about prescriptions and accounting. But the agents were pulling at the threads of the business, hoping to find one that led to whoever sat at the top.

Then, late in the summer of 2012, Paul Le Roux disappeared again. Moran Oz and the other Israelis stopped hearing from him. Rumors swirled that he had gone underground because authorities had intercepted one of his boats carrying arms or drugs. Oz, Berkman, and others pressed Persian Cat for information, but he professed to having no idea where Le Roux was or what had happened to him. The transfers from Hong Kong and the other accounts stopped entirely. “We knew something had happened,” one former manager told me. “We prayed that he was dead.”

Le Roux would sometimes give Israeli employees who had relocated to the Philippines entirely new duties, employing them in parts of the business they had previously known little about. Tales of Le Roux–sponsored operations in exotic locales began to filter back to the call centers in Israel.

Oz got his childhood friend, Asaf Shoshana, who had served in an elite Israeli military unit called the Duvdevan, a job working for Le Roux in the Philippines. Not long after he arrived, though, Shoshana reported back to Oz that he had been put in charge of a logging business in the Democratic Republic of the Congo. Another Philippine Israeli, Shai Reuven, told a friend that he had been assigned to run an elaborate operation to procure gold directly from African mines. Still others were being hired to guard houses that Le Roux owned in Hong Kong.

Sometime in 2007, an Israeli-American named Levi Kugel, a friend of Berkman’s, was invited to come to the Philippines and work for Le Roux directly. Kugel was put in charge of a call center but soon began working closely with Le Roux on projects far beyond the prescription-drug business. “It was love at first sight,” one employee told me of the way Le Roux and Kugel hit it off. By 2008, Oz was hearing stories that Kugel, who was operating under the name Steve Lebaron, was being sent around the world by Le Roux on mysterious business related to Zimbabwe.

Periodically, Kugel would return to Israel, and he and Oz began casually discussing the idea of going into business themselves. Kugel was an American citizen, and the two of them talked about the benefits of starting their own wholesale pharmacy in the U.S. RX Limited’s business had grown so quickly that it often had trouble finding enough pharmacies to fill its orders. By opening their own, they reasoned, they might make a great deal of money and also save Le Roux some in the process.

In early 2009, Oz got a call from Le Roux saying that he had taken on new Brazilian partners and wanted Oz and Berkman to come to the Philippines to meet them. When they arrived, though, Le Roux told Oz, “Alon needs to take care of something. You’ll come with me.”

Le Roux said he wanted Oz to join the Brazilians on a short trip to inspect a potential new call-center site on an island called Cebu. They’d travel on one of Le Roux’s yachts, a full-day trip by boat. The next morning he picked up Oz at the hotel in his BMW. They stopped for breakfast at McDonald’s, then headed west toward the coast. Le Roux owned several boats that he kept docked in Subic Bay, a city two hours from Manila that had housed a U.S. military base in the early 1990s and remained a magnet for international expats, particularly former military types.

Le Roux pulled into the marina, where he put Oz up in a hotel for the night, paying the bill in advance. The Brazilians would meet him the next morning, he said, on the dock next to the yacht they would be taking to Cebu.

The whole thing felt off to Oz—the Brazilians, the boat, Le Roux driving him personally. But by this point, he had little choice but to go along with it.

When Oz arrived at the appointed dock the next morning, three men were waiting to meet him: an older white-haired American or British man named Dave and two Latino-seeming men** who rarely spoke. Dave invited him on board and said he was eager to talk business. It was a small yacht with three bedrooms. Dave said he’d take one, Oz another, and the Brazilians would share the third. It was sunny and warm as they cruised leisurely out to sea. Oz sat on the back deck, taking in the view.

After about a half-hour, with the shoreline now just out of sight, Dave came to the back of the boat and asked Oz to get up for a moment, he needed to get something from the compartment beneath him. Seconds later, Oz was falling overboard.

He assumed at first that he had tripped—he remembered, and quickly regretted, that he’d slid his cell phone into his sock—but then when he looked up, he was confused to see the boat moving away from him. It turned, though, and pulled alongside him. Oz looked up, expecting a ladder to be thrown over so he could be hauled aboard. Instead he saw Dave holding a gun, and before he could process what was happening, bullets were piercing the surface of the water around him.

Then the shooting stopped, and Dave told Oz that they knew he was stealing from Le Roux and they would kill him if he didn’t say where he’d stashed the money.

Oz thrashed about in the water, trying to understand what could possibly have had led to this moment.

Dave now held a satellite phone, from which he seemed to be relaying his interrogation. Dave listened on the phone and then spoke to Oz in the water below him. “We know you are talking to Levi,” he said.

Now Oz understood. Somehow the business he and Kugel had discussed had gotten back to Le Roux. Why they were accusing him of stealing he didn’t know, but bobbing there in the water Oz frantically explained that he and Kugel were just talking, that they’d hatched this idea of a pharmacy on the side that could be good for everyone. “I would have told Paul if we had done it,” Oz said. “I would never do something behind his back.”

Perhaps Dave had never intended to kill Oz, only to terrify him. Or maybe Oz talked his way out of his own execution. Whatever the case, eventually they pulled him back on board and motored to a small, isolated island, where they anchored for the night.

Thirty-six hours later, they headed back to the marina. “You need to understand that we can reach you everywhere, in Israel,” Dave told Oz. He warned that if they ever caught Oz stealing from Le Roux, or even suspected it, they would kill him. “Whatever happens,” Dave said, “we will get to you.”

The next day, Le Roux picked Oz up for the drive back to Manila. In the face of Oz’s confusion and anger, Le Roux denied knowing anything about the incident. He had nothing to do with it, he told Oz. It was the Brazilians, and they were men that Le Roux had to listen to.

Before he dropped Oz back in Manila, Le Roux left him with a warning. “If you are thinking to go to Israel to close the office, I would suggest that you don’t want to deal with these guys. They will find you. Do whatever they say. By all means, don’t go back and panic.”

**It would turn out that it wasn’t so much that Oz believed the pair looked South American, just that he assumed as much because of what he’d been told. In research for The Mastermind book, I discovered that the two men were in fact Joseph Hunter and another member of Le Roux’s mercenary enforcement team working for Dave Smith.

Read the next installment in “The Mastermind” series.

The Mastermind Episode 1: An Arrogant Way of Killing

A journey to understand how a real-estate agent in the Philippines became the target of a criminal mastermind.

By Evan Ratliff

Jeremy Jimena had just started his shift when he found the body. At 6:30 on the morning of February 13, 2012, Jimena, a garbage collector in the Philippines, had set out with his driver on their regular route through Taytay, an industrial city an hour east of Manila. It had rained most of the night, and a light drizzle fell as they turned down Paseo Monte Carlo, a quiet road with no streetlights. Their first stop was a large vacant lot overrun by low shrubs, a green carpet of vines, and a scattering of banana trees.

The field wasn’t an official pickup spot, but local residents often dumped garbage there anyway, and the collectors had informally added it to their route. There was a small pile of trash that morning spilling into the road: two large grain bags filled with waste and a bulging, rolled-up bedspread. Jimena hopped off the truck and approached the pile. When he leaned down and grasped the damp edge of the blanket, he saw a human foot.

Jimena dropped the blanket and ran, shouting to the driver, and the two of them left the truck and sprinted to the municipal headquarters, 200 yards away. There they told Ricardo Maniego, the local head of security, what they found. Maniego called the police and brought a long cord to rope off the area, like he’d learned in first-responder training.

Nearly four years later, in December 2015, I sat with Jimena outside the municipal headquarters. He is a small, wiry man with jet black hair and a wisp of a mustache. He looked off in the distance as he recounted the story, his eyes wide and mournful. He’d known right away that the foot was a woman’s, he said, but couldn’t remember much else. “I was shocked and disoriented,” he said.

After he’d shown Maniego the body, Jimena had returned to his route in a daze. He never spoke to the police, he told me, and never learned who the woman was. But for years, he had dreamed of her every night. “She’s screaming, asking me for help,” he said. “Sometimes she is wrapped in a blanket. Sometimes it wakes me up.”

I came to Taytay that afternoon because I believed that the woman Jimena had found was a small thread in a much larger story. Somewhere between a pile of American legal documents and a two-paragraph story about Jimena’s discovery in a Philippine newspaper, I had noticed a hazy connection between the body and a man named Paul Le Roux, a South African who was reputed to be the most prolific international criminal of the 21st century. The scant information I could find on Le Roux suggested his involvement in weapons shipments, gold smuggling, and online prescription-drug sales. But he was also a kind of phantom, reportedly captured by the United States Drug Enforcement Administration in 2012 and then disappeared to work as a valuable asset. My attempts to find out who Le Roux really was, and why the U.S. wanted so badly to keep him a secret, had led me from New York to Manila and then to this vacant lot, where I suspected that Le Roux’s ghostly influence had once been manifest.

The investigative division of the Taytay police is housed in a neglected cinder-block building on the side of a hill in the town’s historic district. I went there with a local Filipino-American journalist, Aurora Almendral, on the same day I met with Jimena. Almendral and I walked past a woman stapling Christmas decorations to the wall, through a pair of swinging doors, and into a cramped room with four officers’ desks. An air conditioner rattled in the window, and three detectives pecked away on ancient-looking computers.

Almendral, who had been helping me since I’d arrived in the country two days earlier, tried to rouse one of the detectives and explain, in Tagalog, why we were there. (The Philippines’ official languages are English and Filipino, which is a standardized form of Tagalog.) The chief of police had promised to show us where the body was found, but that morning he’d been called away by a kidnapping incident. The other cops, largely indifferent to our desires, had no idea when he would return. The original officer on the case, they said, had left the force and become a sailor.

While we waited, I stared at an oddly menacing police “Loyalty Pledge” that hung framed on the wall. “Remember that an ounce of loyalty is worth a pound of cleverness,” it read.

If you must growl, condemn andeternally find faultWhy! resign your position.And when you are outside,Damn to your hearts content.But as long as your a part of the institution,Do not condemn it.If you do, the first high wind thatcomes along will blow you awayAnd probably you’ll never know why.

After some coaxing from Almendral, an officer named Abigail Del Monte agreed to pull the case file. She returned from a back room and proceeded to flip through it idly at her desk, as if trying to discern why I had flown 8,000 miles and then driven three hours in the Philippines’ punishing traffic to visit a four-year-old crime scene.

Twenty minutes later, another detective, George Arada, wearing jeans and a denim jacket, showed up and suddenly the mood shifted. “You’re here for the Catherine Lee case?” he said. “OK, let’s go.” We offered our slightly beat-up rented van and driver for transportation, and Del Monte decided to join as well. We picked up Maniego, the local watchman, and drove over to the vacant lot.

Maniego showed us how he’d marked off the area back in February 2012. “The body was moved a little bit by the guy who picked up the blanket,” he said, officially. “I didn’t find out anything about who she was, because my job was just the immediate response.”

We walked over to an older woman selling drinks at a roadside stand next to the lot; she said she remembered that day, too. “I saw the body,” she said, “but it was covered up, so we couldn’t see who it was. Three streets down, somebody had been missing for a couple of days, so we thought it could be them.” Later, word came back from the cops that the body belonged to a real estate agent from another part of the country. When I asked what happened to the neighbor, the drink-stand woman said that the family of the missing person had been renters, and not long after they’d moved on.

I walked around taking photos, looking for signs that Jimena’s horrible discovery had somehow transformed this otherwise ordinary place. A group of young kids stopped to watch us, and I wondered if the incident had become part of their childhood lore. Whatever mark the body had left, I couldn’t see it. We piled back into the van, and on the drive back to the station I asked Arada and Del Monte whether they often encountered dead bodies in Taytay, a city of just under 300,000 people. “Sometimes over five in a month, but not over ten,” Arada said cheerfully. “It’s kind of a well-known place to dump bodies. Don’t tell the chief!” He laughed. The cases were difficult to solve, he said. The bodies were often mutilated or “broken up and stuffed in garbage bags.”

I asked if I could look at the case file, and to my surprise Del Monte handed it to me. Photos taken at the crime scene showed the body, unwrapped, lying facedown with its feet in the road, a crowd standing at the edge of the cordon.

The facts were spare: a team from the national police’s Scene of Crime Operations division had arrived at 7:50 that morning to examine the woman, who’d been found wearing a black jacket and jeans. An autopsy report listed the cause of “instantaneous death”: gunshot wounds under each eye.

The investigators had little trouble identifying the victim as Catherine Cristina Lee, a real estate broker from Las Piñas City, an hour south. She was found with her identification, as well as a Nokia smartphone, an Anne Klein wristwatch, a silver bracelet, and a pair of rings, gold and silver. She had not been robbed; there was no sign of sexual assault.

Deeper in the file, I discovered that I wasn’t the first person to travel to the Philippines and ask questions about the body. On one page were handwritten notes from a February 2015 meeting with a special agent from the DEA’s Los Angeles office, along with a copy of his business card. A follow-up report stated that two Americans had been arrested in connection with Lee’s murder. One of the two, according to the notes, had confessed, claiming that a Filipino local had supplied the murder weapon and the vehicle used to dump the body. At the bottom of the page, someone had written: “Hunter ordered.”

A few days after Catherine Lee’s body was discovered, her husband contacted the Philippine National Bureau of Investigation (NBI) and requested that the agency look into her case. The ranks of local and national police in the Philippines are rife with corruption—“planting evidence is pretty much a regular occurrence,” the country’s former interior secretary Rafael Alunan told me—and the NBI has a better, though not perfect, reputation for integrity. The agency is required by law to take over cases at the request of victims’ families, and often those requests stem from concerns that local officers have been paid off, or worse. In targeted killings, as the Lee case appeared to be, it’s not unusual to hear whispers that cops themselves were in on the job. Contract murder is a thriving industry in the Philippines; having someone killed can cost as little as 5,000 pesos, or around $100. But police work pays poorly, and as much as 60 percent of the national police force lives below the poverty line. In 2013, Human Rights Watch documented police involvement in a death squad responsible for almost 300 killings over a six-year period in one city alone.

At NBI headquarters in Manila, the Death Investigation Division was housed in a drab, tiled-floor room with the insipid fluorescent lighting that marks bureaucracies worldwide. On the wall was a whiteboard outlining agents’ assignments, organized by nickname: “Cardinal,” “Undertaker,” “Mechanic,” “Hitman,” “Braveheart,” “Snakedoc,” “KGB.” Almendral and I went there one morning to see an agent named Rizaldy Rivera, a garrulous cop with a waist-length ponytail and a talent for sharpshooting. A natural showman, he urged us to check out his videos on YouTube. (Later I did; the clips—including one in which he cuts a credit card in half at 20 yards with a handgun, aiming over his shoulder using a compact mirror—are impressive.) Most people called him Zaldy, but his nickname around the NBI offices, he said, was Slayer, bestowed after he lucked into three shootouts early in his career, one of which left a bullet in his thigh.

It was Rivera who handled the Catherine Lee case after her husband had requested that the NBI take over the investigation. “I cannot provide the real names of the witnesses, or their addresses and photos, in order to protect them,” Rivera told us as Almendral and I sat in a pair of plastic lawn chairs in his cubicle, across a desk completely devoid of papers or equipment. Otherwise, he said, “I can probably answer any question that you want me to answer.”

He started at the beginning, talking above the sounds of an NBA basketball game from a television somewhere just out of sight. Over the course of an hour, Rivera laid out everything he knew about Catherine Lee’s murder. He spoke in the matter-of-fact style of a cop who had seen his share of vicious crimes. But at times, he sounded genuinely mystified that someone like Lee could end up a target.  

In early February 2012, Catherine Lee received an email from a Canadian man living in Manila named Bill Maxwell. Maxwell said that he and his colleague, Tony, were looking to invest in real estate. They had searched online for a broker and found Lee, a well-known agent whose territory ranged throughout the southern part of the Philippines’ main island, Luzon. A few years prior, she had served as president of her local chapter of the Real Estate Brokers of the Philippines. “She won several trophies and awards,” Rivera said. Lee, who was 43 but looked younger, with a pixie haircut and a welcoming smile, “had good friends and made a good living,” he said.

Lee worked from her home, an attractive house in an upscale community in Las Piñas. She and her husband had purchased it not long before, with the help of a particularly large commission she’d earned. Much of her business came to her over the Internet—enough, at least, that she would be unlikely to think twice about scheduling a meeting with a client by email. “She never bothered to check the background of these people,” Rivera said. “That was her undoing.”

Bill and Tony didn’t specify what type of property they were looking for, only that they wanted a place farther south than Las Piñas; it could be commercial or residential, a vacation property or a ready-to-build lot, as long as it was a solid investment. For two days, she drove them from property to property, but the men weren’t ready to commit. For their third outing, on the morning of February 12, Lee met Bill and Tony on the outdoor patio of a Starbucks in Las Piñas, not far from her home. They were joined by three other real estate brokers she’d enlisted to help with the search.

The Canadians arrived in a silver Toyota Innova van. Bill was around six-foot-one, with a beard and a prominent belly. Tony was clean-shaven and wore a baseball cap. The group drove to a gated community called Ponderosa, a former flower farm located 40 miles south of Manila, where they examined a lush lot available for residential development. For lunch they stopped at a nearby spot popular with the locals called Mushroomburger, where they were joined by two property owners Lee knew at around 3:30 p.m.

The group then traveled to another farm about eight miles away, in Cavite. They arrived at 4:30 and wandered around for an hour. When it was time to leave, the brokers and the property owners departed in one car; Lee joined Bill and Tony in the Innova van. Sometime in the next ten hours, Lee was shot four times in the head at close range, rolled up in a blanket, and deposited in a pile of garbage.

Rivera pieced together Lee’s movements from interviews with her husband and everyone she had encountered that day, as well as information found on her laptop and phone. From her friends and a security guard at the gated community, he gleaned enough of a description of the two men to generate a pair of sketches. But when it came to the actual identity of the assailants, he hit a wall. “It was very hard to check with the immigration bureau in the Philippines,” Rivera said. “Because Bill Maxwell and Tony, the names were fictitious.”

As for physical evidence, there was little to go on. The Toyota van had no plates, although the security guard was able to supply the number from the van’s temporary registration sticker, given to newly purchased vehicles. When Rivera tried to trace it back to a Toyota dealer in Manila, nothing matched. He concluded that the car was probably rented and the number faked. Without the van, there would be no fingerprints, hair, or fibers.

One aspect of the crime stood out to Rivera: Lee had been shot once under each eye, with what forensics had determined was a .22-caliber handgun. “In our experience,” he said, “if you shoot a person dead, you don’t normally use a low-caliber firearm.” Hit men in the Philippines, he said, typically used “Armalite weapons, hand grenades, or a .40-caliber pistol. This is one of the few times that I discovered that the caliber was a .22 Magnum.” To Rivera, the weapon said something about the crime, namely “that it might be a type of signature killing.” He believed that Lee’s death was not a crime of passion but a professional murder committed by someone looking to send a message. “That’s an arrogant way of killing, putting two bullet holes beneath the eye,” he said. “That’s not how you normally execute a person.”

During his investigation, Rivera came across the case of a female customs agent killed in a similar manner. That case stalled, however, when the victim’s family declined to cooperate with the authorities.

After a few months, Rivera’s case dried up, too. Other murders required his attention. But like Jimena, he was haunted by the brutality of Lee’s killing. “I couldn’t sleep soundly at night. I was thinking about that case,” he said. “But the fact is, I cannot just proceed without solid evidence.”

For three years the file languished, until April 2015, when Rivera got a call from the U.S. embassy. The DEA had some information regarding the Catherine Lee case, an embassy liaison said. Almost two years earlier—18 months after Lee was murdered—the DEA had arrested a former Army Ranger who had been working in private security overseas. That arrest had led them to Rivera.

In July 2013, the U.S. Attorney’s Office for the Southern District of New York, covering Manhattan, filed a sealed indictment charging Joseph Hunter, a 48-year-old decorated former U.S. soldier, with conspiracy to murder a law-enforcement agent. More specifically, Hunter stood accused of forming a team of international assassins to take out a snitch and a DEA agent on behalf of a Colombian drug cartel. On September 25, Hunter was captured in a raid on a safe house in Phuket, Thailand, and extradited to the U.S. Two members of his alleged assassination squad, for which he’d accepted résumés over the Internet, were picked up simultaneously in Liberia as they prepared to carry out the hit. The fourth and fifth were caught in Estonia on charges of arranging a drug deal. When I read the unsealed indictment a few days later, the whole thing sounded as if it were concocted by a dramatist with a flair for international intrigue.

In a way it was. The DEA’s entire operation was a version of what’s called a reverse sting—or, in more common terms, a setup. The “Colombian drug lords” were paid informants playing well-rehearsed roles. The snitch and the DEA agent didn’t exist. The “safe house” had been wired for sound and video. For months the DEA had been stringing Hunter and his team along, arranging small gigs like guarding drug shipments in the Caribbean before springing their trap.

When the Department of Justice announced Hunter’s arrest, a wave of media coverage followed—not least because Hunter’s nickname in the field had been Rambo. After the headlines died down, the case embarked on the long slog toward trial. Federal cases often take years to wind their way to a jury, and very few ever make it there. Ninety-five percent end in a guilty plea, because even the best defense lawyers rarely have the wherewithal to face the power of a federal prosecution—particularly one with the kinds of resources that had been brought to bear on the Joseph Hunter case.

On December 21 2014, however, a reporter at The New York Times named Alan Feuer broke a strange new detail in the case. Hunter, he reported, had been working for a mysterious cartel boss named Paul Le Roux, who had once commanded a criminal empire of incredible power and scope. Le Roux had been arrested in 2012, Feuer revealed, and was now working for the U.S. government as a closely held confidential informant. By December 30, the Daily Mail had declared Le Roux “the most successful criminal mastermind you’ve never heard of.”

This second wave of press coverage preceded a pivotal motion in the case, filed by Hunter’s lawyer in Manhattan. It argued that the indictment against Hunter should be dismissed because the sting operation had been initiated by Hunter’s former boss, referred to by the government only as a confidential witness, or CW-1. Hunter had participated in his alleged crimes, the motion asserted, because he believed that his boss would kill him if he did not. The U.S. government’s use of a criminal as vicious as CW-1, the filing asserted, “shocks the conscience.”

Anyone paying attention now knew that CW-1 was Paul Le Roux. His name, however, remained redacted in every court filing. Any case files that might exist detailing Le Roux’s own arrest were sealed.

Then, four weeks later, Hunter suddenly pleaded guilty. There would be no defense that he had acted out of fear of Le Roux, no unmasking of his boss in court. Indeed, there would be no trial at all. Over the course of 2015, all of Hunter’s codefendants pleaded guilty, along with five defendants in a related methamphetamine-smuggling case. Their files were sealed and shelved, the guilty parties dispatched to federal prison or awaiting their sentence.

I’d been following the case largely through court documents. In the spring of 2015, as the trail on Le Roux went cold, I decided to reread everything that had been filed, thousands of pages across more than a dozen cases. Despite the secrecy surrounding Le Roux, it turned out that a great deal of information had been lodged in those documents. There were, for instance, scattered transcripts of recordings taken of Hunter and his team—two former German soldiers, a Polish ex–military sniper, and a fellow former American serviceman—from microphones hidden in the safe house in Phuket. On those recordings, Hunter can be heard preparing his team members to carry out jobs for the supposed Colombians. Hunter refers to killings-for-hire as “bonus work.” (In the transcripts that follow, the abbreviation “U/I” stands for “unintelligible.”)

Hunter: There’s a uhm… there’s a bonus for you [U/I] assassination so if you’re interested in that, you can do it. If you’re not interested and you don’t want to do it, but there’s big bonus money. I don’t, I don’t know [U/I] I say big, but it’s like for [U/I] it’s twenty five thousand and if it, if it’s [U/I] depending on the threat level, the price goes up.

Male 3: Good.

Hunter: So you guys have a problem with that?

Male 3: No.

Hunter: So there’s plenty of bonus for us. So you guys are in?

Male 1: Uhm-hum.

Hunter refers to his boss as “Benny,” or sometimes just “the boss,” and says that he pays up to $25,000 “for the bonus rate.” Hunter boasts about the kind of bonus work he’s done in the past or paid others to do—crimes that, as I read through the filings, didn’t appear to be part of his prosecution by U.S. authorities. “That one year, we killed nine people,” he says at one point, adding: “We only hurt bad people. Right? Everybody that stole money, or conned the boss or whatever.… These are all wrong people so you don’t have to worry about hurting innocent people.”

Even from Hunter’s casual bragging, I was astonished by the scope of the criminal activities his boss seemed to have enlisted him for.

Hunter: When we did it, we did it all. We, we hand grenaded, threw it, hand grenaded the people’s houses. We ah… not kidnapped a guy, but we conned him to come with us. We put him in the ocean, shot at him; he gave us the money back ah… assassinated people. Ah, what else we did? We smuggled gold. We smuggled weapons. Ah… We took weapons from Jakarta to the Philippines on the ship.

One time I went to Sri, Sri Lanka to buy hand grenades. We have guys in Somalia buying weapons that are making an arm… they were. They was making a army in Somalia because we were gonna invade an island; Maldives just… You can’t make it up.

Male 3: Yeah.

Hunter: Not even in a movie. This is real stuff. You see James Bond in the movie and you’re saying, “Oh, I can do that.” Well, you’re gonna do it now. Everything you see, or you’ve thought about you’re gonna do. It’s, it’s real and it’s up to you. You know how the government says if you work through the government [U/I] we don’t know you. Same thing with this job. No different right? So, that’s how it is. Same thing you do in the military except you’re doing for these guys you know? If you get caught in war, you get killed, right? Unless you surrender if they let you surrender or if you get you know, the same thing. This is… Everything’s just like you’re in war [U/I] now.

Here was an American ex-soldier, assisted by other Americans, acting as part of a rogue military-spy operation on behalf of an international criminal figure who, prior to December 2014, the public had never heard of. “El Chapo” Guzman, head of the Sinaloa cartel in Mexico, was by this time a famous figure worldwide. The notorious Russian arms trafficker Viktor Bout, arrested in a sting in Thailand and convicted in 2011, had been the subject of magazine articles, and a Nicolas Cage movie was based loosely on his exploits. But judging from the brief flurry of stories about Le Roux and the fragmented contents of the case files, he seemed to have a criminal appetite more voracious than either of them. In one Times article, a DEA agent called Le Roux “Viktor Bout on steroids.”

A surveillance photo of Le Roux, taken in an airport in Rio de Janeiro, surfaced from a Brazilian newspaper; it was purportedly the only image of him ever published. It’s a grainy shot of a doughy white man in a royal blue polo, with what appears to be tousled bleach-blond or silver hair and a darker, trim beard. He wears a slightly amused expression and, with the photo blown up, almost looks as if he’s winking at someone.

The thing that eventually led me to the Philippines was practically a footnote in the federal indictment against Hunter. Based on the recordings, prosecutors believed that Hunter “had in fact previously committed acts of violence for pay—including, among other things, arranging for the murders of two female real estate agents.” An afterthought to the case itself, the detail had lodged in my brain when I first read it back in 2013, and I kept returning to it. Why had international assassins for hire, working for a man with a worldwide criminal network taken the time to murder two real estate agents?

One of the murders, it turned out, was easy enough to understand. In the transcripts, Hunter described hiring a pair of hit men to kill a customs broker who’d failed to make good after accepting a bribe. “I guess that they had some kind of business with [the boss],” Hunter says in one transcript. “They get stuff through Customs right? They paid her and she didn’t do it.” After putting her under surveillance at home, unnamed assassins hired by Hunter discovered that the broker also worked as a real estate agent. They asked her to show them some rental properties, Hunter recounts, selected the best one at which to leave a body, and then asked to see it a second time. “They didn’t even go inside. They shot her at the door. Left her there, but it was raining that day so … there was no people out,” Hunter says. “They did it perfect no problems.”

Hunter then goes on to describe the killing of the second real estate agent, one that, by his standards, didn’t go as smoothly.

Hunter: I had two guys, two other guys that wanted bonus work. They did the job, but they did it sloppy. I fired them. I sent them back home.

In mid-summer of 2015, three DEA agents met with Agent Rivera at the Death Investigations Division. “How can I help you guys?” Rivera told me he’d asked them. Rivera walked them through what he’d learned about the case, using a PowerPoint presentation to recap the investigation’s key points. When he finished, Rivera asked them jokingly, “From one to ten, how would you rate my investigation?” Everyone laughed. He asked them why they were looking at the Lee incident. “For the U.S. government to be interested in the death of Catherine Lee, it means something,” he said. “The Drug Enforcement Administration of the U.S. is a powerful organization. It handles global drug issues. So, in my mind, I can surmise that the death of Catherine Lee might have been connected to a drug cartel.”

When I visited him later that year, Rivera pulled out an iPad clad in a red case and tapped open the presentation. “Probably I can show you this, but not all,” he said, emphasizing that the witnesses would be in extreme danger if their identities were made public.

The DEA agents confirmed that Rivera’s hunch had been right: Bill Maxwell and Tony weren’t the men’s real names. They were not Canadian, nor did they live in the Philippines. The DEA related to him their suspicion that they were two Americans, 41-year-old Adam Samia and 47-year-old Carl David Stillwell, who lived in the small town of Roxboro, North Carolina.

The DEA agents had arrived in Manila with evidence from Hunter’s email and the recordings taken at the safe house in Thailand. Hunter, it seemed, had used his network of defense-contractor contacts as a mercenary-recruitment service on behalf of his boss. Sometime in 2011, the U.S. was prepared to allege, he had pegged Samia and Stillwell as potential hires for bonus work. “Boss says you are on standby until the other guy is ready and you guys will come here together for Ninja stuff,” Hunter wrote Samia in the fall of that year, according to the prosecution’s filings. “We want you guys, but are just waiting until you and your partner can get on the same time table.”

By early December, Hunter reported back to the boss via email that the travel dates were set for January. “Adam will be leaving on the 8th and will be here on the 9th and the other guy will leave on the 10th and be here on the 11th. The WU”—Western Union, according to court filings—“of $1,625 goes to Adam Samia Roxboro, North Carolina USA.”

The plan was for the pair—whom Hunter referred to as “Sal” and “J.T.”—to fly to Manila, take taxis to a predetermined location, and get settled. The instructions were almost absurdly detailed, given the trip’s ultimate goal. “The taxi should cost like 220p with the tip,” Samia passed along to Stillwell on January 9. A few weeks later, Samia emailed Hunter an update, mixed with a chipper plea for additional cash:

Hey Bro we are going to need some OP funds ($3000.00) we both are just about broke we have spent all are money on finding a place to live, the car, phone load, food, taxi’s looking for a place to live, internet, stuff for here an more. I got them to throw a bed an ac so the boss does not have to buy them trying to save were I can!

Hunter, meanwhile, was requesting the necessary weapons for the job from the boss: “1 MP5 SD,” a semiautomatic rifle, along with “1 Rifle Silenced with optics” and “1 .22 or 380 Pistol Silenced.” Hunter set his charges up with more money, along with the weapons and a laptop bag “modified to hold the tool for concealment.”

By February 2, the DEA believed, Samia and Stillwell had begun tracking their target, following her car and staking out her home from a hardware store across the street. “She goes home there,” Samia allegedly reported to Stillwell, “but [is] always out of the house.” At some point not long after, they finally made contact with her and started looking at properties. Hunter, as he would describe it later in taped conversations, had given them detailed instructions on how to proceed with the hit: Get her into a car, drive a quarter-mile down the road, shoot her with a silenced handgun, and wrap her in a blanket.

“What these guys did, they didn’t listen to me,” Hunter says in one recorded conversation. “They went to all these different houses with her, where there was people living in the houses. So every house they went to, people saw them together. They saw their faces. They saw the real estate agent. So they went… They did this for like three different days. So like one hundred people saw them.”

One hundred may have been an exaggeration, but Hunter was right that enough witnesses had seen two men with Lee that Rivera could generate sketches of them.

Hunter: So I got them on the plane. They were Americans so I got them back to America and then ah, I, I never… I didn’t give them anymore work because they put everyone in danger. I told them “You know how they would get caught? If the police and the Philippines was smart and not lazy, all they had to do was take the witnesses to the airport and look at each picture [U/I] of the foreigners and, and then that’s “Oh, that’s the guy!” Then they have his… they have his passport, his photo, right, but the police in the Philippines aren’t smart and they don’t… they’re lazy. They don’t do nothing. So those guys were lucky.… You got to use your brain in this job.

According to the DEA, on February 14 Samia and Stillwell emailed their expenses to Hunter. On the 27th, Samia let him know that “JT is rolling state side the 29th of FEB, I am heading out the 6th of March, I will drop [off] the car the 5th.” They wired their payments home and caught flights back to the U.S.

Rivera introduced his DEA visitors to the witnesses he had interviewed about Lee’s last days. The agents showed them photos of the two Americans, Rivera told me, “mingled with seven or eight different photos of seven or eight different individuals, to check if the witnesses recognized or could identify the picture.” Five witnesses picked out the same men, Rivera recalled, saying, “‘Yes, this is the guy who rode with us.’ ‘This is the guy who rode with Catherine Lee.’ ‘This is the other guy who was with Catherine Lee the day she was last seen alive.’” Rivera said that after those sessions, one of the DEA agents faxed a report back to the States. The next day, Samia and Stillwell were arrested in Roxboro.

Local media reports described the pair as well-liked local guys who ran a small gun-paraphernalia company together.They traveled to gun shows to market accessories of their own invention, including a bra that doubled as a holster, called a Bosom Buddy. Agents seized over 150 weapons from Stillwell’s home. But aside from a few pictures on Samia’s Facebook page showing him brandishing and firing a variety of weapons—the kind of gun love that wouldn’t raise an eyebrow in most rural communities in America—they did not otherwise give off the impression of being international assassins. “Just knowing that these people have been in our community,” a neighbor told reporters, “I never would have guessed it.” The day after their arrest, the pair were transferred to New York to be prosecuted alongside Joseph Hunter. Both have pleaded not guilty to murder-for-hire, among other charges.

For his part, Rivera seemed pleased with the arrests, but he also expressed frustration about his own continuing investigation. The agents had told him about the Filipino who allegedly supplied the weapon and vehicle, but he still didn’t have enough information to track them down. He pointed out to me that the NBI hadn’t gotten any credit for the arrests of Samia and Stillwell, while at the same time suggesting that such credit was unnecessary. “We were not included. We were happy about that, it’s no problem with us. We have nothing to gain with being famous.”

It did seem odd to me, sitting in a cubicle at the Death Investigations Division, that the U.S. government would put this much effort into prosecuting two Americans for a murder of a Filipino woman outside Manila. Why not just extradite the pair to the Philippines, where the crime occurred, and hand them off to the NBI? Perhaps it was related to something more fundamental about the case that I still didn’t understand: Why was Catherine Lee important enough to fly two men across the world and pay them $70,000 to kill her?

It was because of “the Mastermind,” Rivera told me. “He is in U.S. custody.” Rivera would only identify this Mastermind at first by alluding to his role as the head of a powerful crime syndicate. But he did tell me the motive behind the murder. Rivera said that the Mastermind had enlisted Catherine Lee to purchase vacation property in Batangas, a coastal region south of Manila. He had given her money, at least 50 million pesos, or almost $3 million. “But the deal never materialized,” Rivera said, “because the person who Catherine Lee instructed to do the verification of the land, to arrange the deeds and everything, went off with the money.”

That person, some kind of fixer Lee worked with, had also been killed, Rivera believed. “The body was never found,” he said.

And then the Mastermind had ordered Lee’s murder, too.

I asked him if he would tell me the name of the Mastermind, and at first he demurred. He did have a name, he said, but he didn’t want to say it. “Maybe it’s an alias.”

“If I tell you the name that I think it is, will you tell me if that’s the person?”

“I will confirm,” he said.

“Paul Le Roux.”

Rivera slammed his fist down on the table, then held my gaze for several seconds in silence. “Hey, they did not inform me that,” he finally said with a smile that was hard to read. The DEA, he said, would “neither confirm nor deny it.” Then he lowered his voice to a whisper. “This Paul Le Roux,” he said, “is a very badass guy.” He widened his eyes. “A bad guy,” he said again. “That’s it.”

Update: On March 6, prosecutors released a bombshell motion in the case, claiming that Carl David Stillwell retained cell-phone photos dated the day of Catherine Lee’s murder—photos that “appear to depict, among other things, a white van similar to the one in which (according to witness accounts) Lee was murdered and a wounded human head.”

Read the next installment in “The Mastermind.”