Security1 publisher2 min readPublished
DOJ charges Oxygen Forensics leaders with hiding the Russian ownership behind their forensic tools
US prosecutors charged Oxygen Forensics' CEO and a co-founder with hiding that five Russians owned the forensic firm and that its software was Russian-built. Police in seven EU states bought or accredited the tool, two of them this September.
The Watch · Security desk
Drafted by a language model from the sources cited here and checked against its claim ledger before publication. How we use AISend a correction
What happened
- Prosecutors allege the concealment ran while Oxygen sold forensic tools to the Pentagon, the Secret Service and other US agencies.
- The same five owners controlled MKO Systems, a Russian company selling the same underlying technology to the FSB and Russia's Interior Ministry.
- Documents reviewed by Politico show Oxygen was consulted on EVIDENCE, a 2014-2016 EU project funded with more than 1.9 million euros, alongside Europol and Eurojust.
- INSPECTr, a Horizon 2020 project that built software to feed Oxygen extractions into other investigative systems, ran until 2023.
- French outlet Disclose reported that Oxygen's software reached Moroccan authorities through an EU-funded border management program covering the Maghreb.
Compiled by The WatchSomething wrong?How this is made
Why it matters
- decision Buyers of forensic and investigative software who accept a vendor's own ownership declaration are relying on the same check Oxygen's CEO allegedly falsified to US agencies.
- constraint Screening keyed to a vendor's registration, like the Horizon Europe bar on Russian entities, would not catch a Virginia-based company whose owners and developers were in Russia.
- contradiction The Commission says Oxygen took no direct EU funding, while Disclose says EU money paid for courses Oxygen staff taught to Moroccan police. Both can be true only if the money reached Oxygen indirectly.
"Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia," the Justice Department said [2]. The department says the two men were arrested on a federal criminal complaint [1]. Security Affairs calls the case an indictment [4].
The complaint charges concealment of who owned the company and where the code was built [1]. None of the reporting so far alleges that the software leaked case data or carried a backdoor [1]. The exposure on the record is provenance, and the tool sat inside real casework. A prosecutor's office in Sardinia listed Oxygen among its recognized mobile-extraction systems as recently as April 2026 [13]. A Spanish National Police inspector accredited by the company co-authored a 2026 study on cracking WhatsApp data on Android and iPhone [14].
The seven EU states are Germany, Spain, Italy and Poland, which appear in EU tender records as buyers or accreditors [11], plus Hungary, Romania and Latvia [1]. Sales kept going after Russia's full-scale invasion of Ukraine in February 2022 [7]. Hungary's police signed a contract worth roughly 27,000 euros in December 2024, running through the end of last year [12]. Romania and Latvia bought as recently as this September, days before the arrests [15].
What to watch
- Whether the federal complaint becomes an indictment, and whether later filings describe how Oxygen's software was developed or updated from Russia.
- Whether police in Germany, Spain, Italy, Poland, Hungary, Romania or Latvia suspend Oxygen licenses or accreditations.
- Whether the European Commission accounts for the EU-funded Morocco training that Disclose says Oxygen employees delivered.