Read an excerpt from The Mastermind – the incredible true story of Paul Le Roux, the coder from Krugersdorp who became an international crime boss.

The Mastermind is Evan Ratliff’s investigation into the decade-long quest to bring down Le Roux – the creator of a frighteningly powerful internet-enabled cartel who merged the ruthlessness of a drug lord with the technological savvy of a Silicon Valley entrepreneur.

‘Evan Ratliff has pried open a hidden world of high-tech gangsters and drug kingpins and double-crossers and stone-cold hitmen.’
– David Grann, author of Killers of the Flower Moon

It all started as an online prescription drug network, supplying hundreds of millions of dollars’ worth of painkillers to American customers. It would not stop there. Before long, the business had turned into a sprawling multinational conglomerate engaged in almost every conceivable aspect of criminal mayhem. Yachts carrying $100 million in cocaine. Safe houses in Hong Kong filled with gold bars. Shipments of methamphetamine from North Korea. Weapons deals with Iran. Mercenary armies in Somalia. Teams of hit men in the Philippines. Encryption programs so advanced that the government could not break them.

The man behind it all, pulling the strings from a laptop in Manila, was Paul Calder Le Roux—a reclusive programmer turned criminal genius who could only exist in the networked world of the twenty-first century, and the kind of self-made crime boss that American law enforcement had never imagined.

For half a decade, DEA agents played a global game of cat-and-mouse with Le Roux as he left terror and chaos in his wake. Each time they came close, he would slip away. It would take relentless investigative work, and a shocking betrayal from within his organisation, to catch him. And when he was finally caught, the story turned again, as Le Roux struck a deal to bring down his own organisation and the people he had once employed.

Award-winning investigative journalist Evan Ratliff spent four years piecing together this intricate puzzle, chasing Le Roux’s empire and his shadowy henchmen around the world, conducting hundreds of interviews and uncovering thousands of documents. The result is a riveting, unprecedented account of a crime boss built by and for the digital age.

‘A true crime classic.’
– Publishers Weekly (starred review)

‘If truth is stranger than fiction, then The Mastermind is the truest book you’ll read this year. The only thing predictable about it is how quickly you’ll turn the pages.’
– Noah Hawley, author of Before the Fall and creator of the TV series Fargo

Read an excerpt:

~~~

1

The Investigators

2007–2008 … Two rookie investigators start pulling on strings … The vastness of RX Limited emerges … Going undercover online … Kent Bailey gets drafted … A phone call to Somalia

The whole thing started with a spreadsheet. DEA investigator Kimberly Brill was sitting in her government-issue cubicle in downtown Minneapolis one afternoon in October 2007 when a package arrived from FedEx. Not just via FedEx, but from the FedEx corporation itself. On a hunch, Brill and another investigator, Steven Holdren, had sent a subpoena to the shipping company weeks before, asking for all records on an account used by a pharmacy called Altgeld Garden Drug, on the South Side of Chicago. Brill and Holdren were what the DEA calls ‘diversion investigators’, who focus on the ways prescription drugs are diverted into illegal markets. Unlike DEA ‘agents’, diversion investigators don’t carry guns and have no power to arrest anyone. The glamour busts of cartel bosses and meth distribution rings were typically as distant from Brill and Holdren’s work as a murder case is from a traffic cop’s. Most of their time was spent taking down shady doctors and pharmacy ‘pill mills’, for overprescribing and overdispensing addictive or dangerous medications.

Altgeld appeared to be just such a target. Brill and Holdren had come across it by searching the internet for websites selling a drug called phentermine, a type of amphetamine. Phentermine is a ‘controlled substance’ under US law: illegal to sell without a prescription and heavily regulated because of its potential for abuse, making it a classic candidate for diversion. Brill and Holdren had little problem finding online sellers willing to ship it without a prescription. So they’d bought some using undercover names and credit cards, in what the DEA calls a ‘controlled buy’. When the drugs arrived via FedEx, they had the evidence they needed to go after the pharmacy for illegal distribution. All of this was routine, the kind of low-level buy-and-bust operation that diversion investigators carry out all the time. But Brill and Holdren decided to look one layer deeper: They sent out the subpoena to FedEx requesting data on the shipping account used by Altgeld.

Looking back later, it would seem almost preposterous that such a small decision could lead them into a maze of complexity and criminality, one that connected a small pharmacy in Chicago to a murdered real estate agent in the Philippines. But every chess match has to start with an opening move.

Holdren wasn’t at his cubicle when the FedEx package arrived – he had just stepped out for a walk – so Brill opened it at her desk, extracted a small thumb drive, and popped it into her computer. She opened up the spreadsheet file on it and began scrolling through. Then she picked up the phone and called Holdren on his cell.

‘Oh my God, Steve,’ she said. ‘You’ve got to see this.’

Brill and Holdren were, by most measures, still rookies at the DEA – not necessarily the investigators first on the list for big cases. They had met three years before at the DEA Training Academy in Quantico, Virginia, and were both assigned to the Minnesota office by chance. Brill, a native Minnesotan, had joined the DEA at the age of thirty-three. She’d graduated from the University of North Dakota law school and worked for half a decade as an attorney before deciding to join the government. She was the portrait of a hardworking Midwesterner – friendly and understated, but relentlessly disciplined. ‘I was a first child, a rule follower,’ she said. She was attracted to the DEA by the idea of catching doctors and pharmacists who had betrayed their oaths appealed to her.

Holdren had spent his whole career in law enforcement, also entering the DEA at thirty-three after stints as a Border Patrol agent and an investigator in the US Office of Personnel Management, where he conducted national security background checks. Both investigators were familiar with the basics of tracking Web pharmacies, having undergone an online investigation course as part of their thirteen-week training at Quantico. Called Basic Telecommunications Exploitation, it covered how to use the Internet to build a case using controlled buys.

Long before the national opioid epidemic began making headlines, the DEA had become concerned with the proliferation of prescription drug sales online, and the potential for Web pharmacies to funnel dangerous medication onto American streets. But in their first few years at the DEA, Brill and Holdren both found themselves attacking what they felt was the outer edge of the problem. They would bust one online pharmacy, only to find that another had sprung up in its place. Like a pair of city cops who only picked up corner dealers, they weren’t making a dent in the criminal organisation supplying the drugs to the street.

Brill and Holdren had been talking for a while about finding a case to work together, fifty-fifty, something that would go beyond local pharmacy raids. ‘We were trying to get to the head of the beast,’ as Brill put it. ‘Somebody had to be paying, and somebody had to be profiting greatly. And they needed help running such a large operation. I don’t think we knew. It could be anybody.’ Now, buried in the lines of the spreadsheet on Brill’s screen were the outlines of a case unlike any that they had ever seen.

There were hundreds of thousands of entries, and they weren’t just shipments from one mom-and-pop pharmacy in Chicago. Instead, a single national shipping account, #22328, was being used by more than forty other drugstores. Collectively these pharmacies were shipping thousands of drug orders a week. ‘You could see that there were these pharmacies all over the country, shipping to customers all over the country,’ Brill said.

The account had been registered and paid for by a company called RX Limited. There were several emails and two phone numbers attached to the account, along with Florida and Texas addresses that both turned out to be ‘mail drops’, a kind of virtual mailbox bought over the internet. RX Limited itself was registered as a corporation in Delaware. The organisation clearly was trying to act like a legitimate American business, but from what Brill and Holdren could tell, it wasn’t any type of pharmaceutical company or wholesale distributor. Other than the mail drops, it seemed to have no real American presence at all.

Whatever RX Limited was, it was engaged in the distribution of a staggering amount of pharmaceuticals. Additional subpoenas produced still more spreadsheets, showing that account #22328 and others connected to it had been used by more than 100 pharmacies since late 2006. ‘They were located in different parts of the United States,’ Brill later testified. ‘They were smaller, independent pharmacies, so not things like CVS or Walgreens.’ In one three-week period in 2007, the investigators discovered that these pharmacies had collectively shipped more than 57,000 drug orders. The math was mind-boggling: RX Limited was, at a minimum, responsible for shipping millions of orders of prescription drugs a year through FedEx.

The spreadsheets showed that the customers receiving the pills, like the pharmacies sending them, were scattered around the country. Those customers’ orders rarely originated at their local pharmacies. An order placed online in Illinois was just as likely to be shipped from an RX Limited-connected pharmacy in Tennessee as from one down the street.

To understand how all this was possible, Brill and Holdren needed to get inside the pharmacies themselves. Over the next few months, working from opposite ends of the diversion group’s small cluster of cubicles in the DEA’s concrete tower in Minneapolis, they pulled the names of three RX Limited drugstores off the FedEx account, one each in Minnesota, Texas, and Illinois. With the help of the states’ pharmacy boards, they then conducted what looked like routine inspections. On one of the visits, to La Joya Drugs in Chicago, they hit the jackpot: A pharmacy technician happily walked the investigators through the steps they took to fill RX Limited’s online orders. RX Limited had provided La Joya Drugs with a free computer, printer, and FedEx supplies, together with a step-by-step manual. The technician would log on to a website, download a document containing drug orders, then open a custom program called ‘PCMS.’ Inside PCMS, which seemed to be software created by RX Limited solely for this purpose, the technician could check off each order as it was filled, then generate the FedEx label and send out the drugs.

That explained how these small pharmacies were able to ship such a huge volume: RX Limited was supplying both the orders and the technology to fill them. But where were the orders coming from in the first place?

Holdren typed the name ‘RX Limited,’ together with the Texas mail-drop address, into a search engine and turned up a site called Acmemeds.com. The site looked like a legitimate online drugstore. Calling itself a ‘trusted online pharmacy since 2004,’ it featured a stock photograph of a doctor and a note offering ‘US-LICENSED PHARMACIES, US-LICENSED PHYSICIANS, FEDEX OVERNIGHT SHIPPING.’ Visitors to the site could search among dozens of drugs and place an order using a credit card. If they ran into any trouble, they could call a 24/7 toll-free customer service line, or access a live help chat.

By searching the Web using blocks of text and phone numbers they found on Acmemeds.com, Holdren and Brill would eventually discover hundreds of similar websites, with names like Cheaprx meds.net, Allpharmmeds.com, Buymedscheap.com, Your-pills.com, Speedyrxdrugs.com, All-the-best-rx.com, Ibuymedscheap.com, my-online-drugstore.com, Preapprovedrx.com, Matrixmeds.com, and 123onlinepharmacy.com. Not all of the sites were necessarily owned by RX Limited directly. Many of them appeared to be what are called ‘affiliates’: a kind of marketing front that independent contractors on the internet could set up and use to attract drugbuying customers, who were then funneled into the RX Limited network.

To attract affiliates, RX Limited offered a premade website and the promise of a 60 percent commission on every sale. Those commissions were coordinated through sites like RXPayouts.com, Netbizbucks.com, and Pillengine.com. ‘Open your own online pharmacy,’ the banner atop RxPayouts.com proclaimed. ‘The RxPayouts.com Affiliate Program is the premier pharmacy opportunity on the internet.’ The affiliates’ marketing strategy seemed largely to involve sending spam email to massive mailing lists, and gaming search engines so that a site like Your-pills.com would appear atop the results when someone searched for a particular drug name on Google.

The websites seemed to offer a wide range of drugs, everything from Propecia, the antibaldness pill, to generic forms of Viagra. But when Brill and Holdren started digging into the pharmacies’ records, they discovered the vast bulk of RX Limited’s business derived from three specific drugs. The first, Ultram, was the brand name for a synthetic opioid called tramadol, which – like the better-known opioids OxyContin and fentanyl – was developing a reputation for abuse, although largely outside of the United States. Soma, generic name carisoprodol, was a muscle relaxant often prescribed for back problems. And Fioricet was also often prescribed to treat tension headaches and migraines. In addition to being powerful painkillers, the three drugs shared another property Brill and Holdren realized was crucial to RX Limited’s scope: None were considered ‘controlled substances’ by the US government.

Dictated by an ever-evolving law known as the Controlled Substances Act, drugs that the government views as dangerous are classified according to five ‘schedules’, ranked roughly from most dangerous to least using roman numerals I through V. Schedule I includes drugs that the US government has deemed lack any medical application and have a high potential for abuse, including heroin and LSD. Schedule II drugs such as OxyContin and fentanyl, by contrast, have medical applications but retain a high potential for abuse and harm. Schedule III drugs are considered slightly less dangerous, and so on.

The RX Limited network of websites did not appear to traffic in scheduled drugs. Indeed, the websites themselves demonstrated a sharp awareness of the lines around US drug law, with prominent disclaimers stating that they did not offer controlled substances. But evidence was growing that Ultram, Soma and Fioricet weren’t, as commonly portrayed, ‘safe’ alternatives to OxyContin. As far as Brill and Holdren were concerned, the drugs were ‘habit forming’ at a minimum. RX Limited’s focus on these three painkillers, the investigators concluded, was a deliberate effort to avoid legal scrutiny.

If RX Limited was potentially skirting the law in one way, Brill and Holdren suspected it might be breaking it in others. For starters, Fioricet contained an ingredient that was controlled, a schedule III drug called butalbital. In Fioricet, it was mixed with caffeine and acetaminophen, the ingredient commonly found in Tylenol. Whether the combination met the criteria for a controlled substance wasn’t entirely clear, but it hardly mattered: As a technical, legal matter, even noncontrolled drugs required a valid prescription to distribute. RX Limited sites like Acmemeds.com seemed to acknowledge this reality as well, with prominent disclaimers: ‘Our company is committed to meeting and exceeding all Government regulations covering this new form of healthcare provision. Acmemeds.com will only refer your order to certified physicians that are fully licensed.’

Even if that were true – though the investigators strongly doubted it was – the volume of prescriptions flowing through the FedEx account didn’t make sense. Over the previous sixteen months, Brill and Holdren estimated, RX Limited had delivered seventy-two million doses of painkillers to Americans. Something about RX Limited smelled illegal, and dangerous. They just weren’t exactly sure what it was yet.

The best way to figure it out, they decided, was to start making undercover buys. Brill concocted an identity, ‘Sarah Johnson’, arranged for a fake Minnesota ID, and bought prepaid credit cards at the nearby Mall of America. Then, on Acmemeds.com and other sites, she signed up as a customer. For an address, she used her own mail drop, near the office. Her first order was for thirty tablets of Soma, the muscle relaxant. On the order page, she was taken to a ‘medical questionnaire’ that the site claimed would be reviewed by a doctor. There she was asked to answer yes or no to questions like, ‘Is your personal healthcare practitioner aware that you are requesting this medication?’ and ‘Have you had a physical exam in the last 12 months?’ The questionnaire had a blank space for symptoms. Brill typed in ‘back spasms’ and submitted her order. A customer service representative from the site followed up with an email, reporting that the order had been ‘queued’ for review.

Over the next year, Brill and Holdren made dozens of such orders, following the same process each time. The symptoms that ‘Sarah Johnson’ offered ranged from ‘back pain’ to ‘neck’ to a made-up condition they called ‘stratuski’. She never heard from a doctor. Each time, her order was eventually approved and shipped out, complete with a tracking number and confirmation email. When the delivery arrived, it came labelled with the doctor who had written the prescription and the pharmacy that had filled it. When Brill and Holdren had the drugs tested at DEA labs, the results were always the same: RX Limited had supplied exactly what Sarah Johnson had ordered.

The investigators were getting a full picture of how RX Limited operated. The network’s websites took online orders from customers in the United States, who found the sites through spam emails and ordinary online searches for painkillers. Those orders were then funnelled, virtually, to real American doctors who wrote real prescriptions, without ever meeting their patients. Those prescriptions were then sent electronically to real independent pharmacies to be filled and shipped using RX Limited-supplied technology. The doctors and pharmacies themselves were disposable to the organisation, Brill realised. Take one out, and another could simply be slotted into place. The network kept humming on.

The scheme was so multilayered that none of the deliveries Brill and Holdren had received made any reference to RX Limited. ‘The pharmacies don’t know the other pharmacies, the doctors don’t know the other doctors,’ Brill said. ‘None of them ultimately know who they are working for.’

Neither, at this point, did Brill or Holdren. There was, however, one unusual name that surfaced several times in the data. It was the thinnest of reeds at first, one they had spotted in the hundreds of thousands of lines in the FedEx spreadsheets. Amid the shipments of pills fanning out across the United States, they found one international order: a package delivered to a hotel in Manila in 2005 to someone named Paul Le Roux.

Kent Bailey was at a bar in Minneapolis when he first heard the name that would come to dominate his life. It was the spring of 2008, and Bailey, a veteran special agent with the DEA – the guntoting kind – had recently transferred from the Twin Cities to Chantilly, Virginia, to join the agency’s Special Operations Division. Located at its own headquarters twenty-five miles east of DC, SOD was formed in 1994 to coordinate complicated investigations involving multiple agencies and jurisdictions, cases that spanned domestic and international drug trafficking. After a decade and a half chasing dealers on the street, Bailey had been promoted to SOD, as a supervising agent in the Pharmaceutical, Chemical, and Internet division. A weekend visit back to Minnesota coincided with a going-away party for one of the agents on his former team, at a downtown sports bar called Matty B’s. At one point during the festivities, a pair of diversion investigators Bailey knew from the office buttonholed him.

‘Hey, I want to ask you something,’ Kimberly Brill said. She and the other investigator, Steven Holdren, had been poking around on a case for several months, something they thought could be big. Between beers, Brill and Holdren outlined the basics of what they’d found on RX Limited, trying to impress upon Bailey that it all amounted to something more than just a typical pill mill. Altgeld and the other pharmacies weren’t online businesses; they were merely the front line fulfilment of a much larger network. ‘This is national scale,’ Brill told Bailey. ‘We think it’s illegal. Is there anything you can do to help?’

Bailey, after feigning outrage that they hadn’t called him sooner, said he’d take a look. ‘Send me the email addresses and whatever telephone numbers you have. I’ll start running them in our databases to see what’s happening.’

Le Roux’s name had surfaced several more times in the investigation, after Brill and Holdren had initially seen it on the FedEx package delivered in Manila. For one, they’d determined that RX Limited was renting server space at a company called Q9 in Canada, with an account tied to the email pleroux@swprofessionals.com. The email led them to a defunct website for a programming business called Software Professionals, registered in Mauritius but located in South Africa – and owned by one Paul Le Roux. The name had started to rise up their list of important figures in RX Limited.

They also noticed that several of the servers at Q9 were named after chess pieces, they told Bailey. It almost felt like an invitation to join the game. They’d christened the case Operation Checkmate.

A few days after his 2008 encounter with Brill and Holdren, Bailey was back at his desk in Virginia. The East Coast posting wasn’t much of a natural habitat for the forty-six-year-old agent. He’d grown up in a tiny town in Minnesota called Thief River Falls, just across the border from Winnipeg. Options out of high school were limited, so he enlisted in the Army at age seventeen to become an airborne radio operator. Believing he was training to manage communications equipment on planes, he quickly discovered that instead he would be carrying a radio and jumping out of them. ‘My recruiter lied to me,’ he said. ‘If I’d known what I was going to end up doing I would have said no frickin’ way.’

He took to it, though, and eventually he joined the Army’s Special Forces 2nd Ranger Battalion in Ft Lewis, Washington. By the early 1990s, back injuries from jumping kept him out of the First Gulf War, and threatened to confine him to a desk job. One day he was assigned to train a group of visiting DEA agents preparing for operations in South America – survival, escape and evasion, booby traps. After a few weeks of hanging out with them, he decided to quit the military and join the agency.

After his training Bailey landed in LA, where the agency was targeting drug-trafficking organisations south of the border. Bailey employed his friendly Midwestern accent to mask a no-bullshit approach to law enforcement, and paid his dues with gruelling street work. In an eighteen-month investigation tagged Operation Silent Thunder, he helped crack a methamphetamine ring in which Hells Angels had linked up with Mexican traffickers and white supremacists, resulting in almost three hundred arrests. Over the years, Bailey developed a philosophy about the kingpins on the other side of the law. Even the most successful ones, he concluded, generally weren’t the evil geniuses that they appeared from the street. Their every manoeuvre might look perfectly calculated. But when the agents finally had them in custody, they would usually discover that those brilliant evasions were, more often than not, just dumb luck.

After four years in Los Angeles, Bailey’s wife pressed him to look for a post closer to their extended family. He found one as a field supervisor in Minneapolis, running a team that did everything from street busts to multistate investigations. In September 2007, when he was offered the promotion to SOD, he viewed it as a step up in title but not necessarily in duties. The Internet division was staffed by diversion investigators, and dealt largely with offshore pharmacies in India and China. He’d worked the Southwest border, and thought he should be chasing Mexican cartels, where the action was. I have to have agents help me get on the internet, and I’ve taken Vicodin once in my life, he thought. What the fuck do I know about this?

But Bailey prided himself on outworking any problem. In Virginia he chose a small desk under an air vent and set up a telephone and three computer screens: one for internal work only, one for classified documents, and one connected to the outside internet. He viewed the job as a temporary way station. His wife and two kids had stayed back in Minnesota. He’d try to make the best of it.

Now, sitting in front of his monitors in the spring of 2008, he considered Brill and Holdren’s pleadings at the bar. He examined the list of email addresses and phone numbers they had managed to gather off the FedEx account and their controlled buys. From the outset, he could see that whatever RX Limited was, it was international, its communications tracing arcs across the globe. The Special Operations Division existed for precisely this kind of case.

Bailey started with a phone number that particularly interested the investigators: a Philippine mobile they’d found registered to Paul Le Roux, the man who had received the package in Manila. Bailey passed the number to an analyst at SOD and got a report back listing its last thirty days’ worth of calls. ‘I see numbers to Ghana,’ he said. ‘I see numbers to the Congo. I see numbers to the Philippines, obviously. I see numbers in Brazil.’

Then Bailey saw a series of calls that stopped him cold. They were back and forth to Somalia. Suddenly he began to suspect that he was dealing with something larger than just RX Limited. He’d never been to Somalia, but ‘those are my brothers that went down in Black Hawk Down; that’s the battalion I served in for twelve years,’ he said. ‘People go to those places because they are lawless.’ He still knew almost nothing about Le Roux, but looking at those calls, he was certain of one thing. ‘This guy is not setting up a fucking pharmacy in Somalia.’

• Source: Penguin Random House (PDF)

Categories Non-fiction South Africa South African Current Affairs

Tags Book excerpts Book extracts Paul Le Roux Penguin Random House SA The Mastermind