Mumbai Press Center

November 3, 2026 | [FEATURE] The TrueCrypt Enigma: A Chronicle of Cryptography, Crime, and Erasure | Part I

The story of TrueCrypt is not merely the history of a piece of software.

It is a sprawling narrative that begins with a brilliant, criminal mind, intersects with the most significant intelligence leak of the twenty-first century, and culminates in a digital vanishing act that has fueled more than a decade of speculation.

It is a tale populated by anonymous developers, a drug lord turned informant, a besieged email provider, and the world's most powerful intelligence agency.

At its heart lies a fundamental and unresolved question: why did a tool that had just passed the first phase of a professional security audit abruptly disappear—and who was so invested in erasing its history?

This is what is known, what is suspected, and what remains, stubbornly, unknown.

Part I: The Ghost in the Code – Paul Le Roux and E4M

The story does not begin with TrueCrypt itself, but with its foundational code and the man who wrote it.

In the late 1990s, a South African programmer named Paul Le Roux developed Encryption for the Masses, or E4M, an open-source disk encryption program.

Le Roux was no ordinary developer.

He would later become notorious as a criminal cartel boss, a global drug kingpin and weapons dealer, operating a vast illicit empire from his laptop before his arrest by the DEA in 2012.

One judge would describe his conduct as being in keeping with "the villain in a James Bond movie."

Yet he was also a genuinely accomplished engineer.

E4M's development ended in 2000.

Four years later, in February 2004, TrueCrypt appeared.

The technical relationship between them is not speculative.

TrueCrypt 1.0 was built directly upon E4M's codebase.

Its source headers credited E4M 2.02a, and its license incorporated the E4M license.

VeraCrypt, TrueCrypt's successor, continues to acknowledge Le Roux as the person who "opened the E4M source code" from which TrueCrypt was derived.

The lineage is documented.

The authorship of the successor is not.

Le Roux has denied direct involvement with TrueCrypt, admitting only to creating E4M.

No alternative author or team has been credibly identified publicly, however, leaving the man who wrote its foundational code as the most prominent candidate behind the project's anonymous façade.

The distinction matters: E4M's contribution is established; Le Roux's continued involvement remains an inference.

The SecurStar Dispute and the First Crisis

That ambiguity was present almost from the beginning.

Shortly after version 1.0 was released in 2004, the TrueCrypt Team reported receiving an email from Wilfried Hafner, the manager of the computer security company SecurStar.

According to the team's account, Hafner alleged that Le Roux had stolen the E4M source code from SecurStar while employed there.

He further claimed that Le Roux had distributed it illegally and issued an invalid license permitting derivative projects such as TrueCrypt.

The accusation had an immediate effect.

The TrueCrypt Team stopped developing and distributing the software, announcing the halt online.

A figure named David Tesařík, identified as a team member, subsequently stated that Le Roux had informed them of a legal dispute with SecurStar and had received legal advice not to comment.

TrueCrypt survived this first crisis, but the episode established an important precedent.

From its inception, the project was entangled with disputes surrounding Le Roux, and its developers understood that legal pressure could threaten software whose cryptography remained intact.

Years before the final shutdown, development had already stopped once in response to an external threat.

Asia/Pacific Press Office - Mumbai Press Center