Oxygen Forensics, A Russian-run forensics firm spent a decade inside European police departments

A Justice Department indictment charges CEO Lee Reiber and Russian co-founder Oleg Davydov with concealing that Oxygen Forensics, a software company selling forensic tools to US agencies, was owned and controlled by Russian nationals and developed in Russia. The indictment alleges that Reiber represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when five Russian nationals including Davydov owned and controlled it, and the software was developed in Russia.
Oxygen Forensics was involved in two EU-funded projects: EVIDENCE (2014–2016) and INSPECTr (Horizon 2020), which involved consulting with bodies like Europol and Eurojust on digital evidence collection and analysis. While the EU noted Russian entities were excluded from Horizon Europe projects post-invasion, Oxygen was consulted on these related projects.
The focus shifts to the Russian involvement, noting that the same five individuals allegedly controlled both Oxygen Forensics and MKO Systems, a company selling similar technology to the FSB and Russia’s Interior Ministry. Furthermore, Oxygen's tools were used by various European police agencies, including those in Germany, Spain, Italy, and Poland, as evidenced by EU tender records. External reporting also suggests the software was used for training Moroccan authorities through an EU-funded border management program.

* The Justice Department announced a federal criminal complaint charging CEO Lee Reiber and Russian co-founder Oleg Davydov with concealing that Oxygen Forensics was Russian-owned and its software was built in Russia.
* Reiber allegedly represented to the U.S. government that the company had no foreign ownership or control and that its software was developed in the United States.
* The indictment alleges five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia.
* Oxygen Forensics was involved in an EU-funded project named EVIDENCE (2014–2016), receiving over €1.9 million in funding and consulting Europol, Eurojust, and the European Anti-Fraud Office’s digital forensics unit.
* Oxygen Forensics participated in the INSPECTr project, funded by Horizon 2020, which developed software to combine digital evidence.
* INSPECTr continued operation until 2023.
* Police agencies in Germany, Spain, Italy, and Poland accredited or purchased Oxygen’s products according to EU tender records.
* Hungary’s police signed a contract worth approximately €27,000 in December 2024.
* A prosecutor’s office in Sardinia listed Oxygen among recognized mobile-extraction systems as recently as April 2026.
* A Spanish National Police inspector accredited by the company co-authored a 2026 study on cracking WhatsApp data on Android and iPhone.
* Oxygen’s software was provided to Moroccan authorities through an EU-funded border management program covering the Maghreb.

The narrative reveals a systemic layering where commercial technology intersects with state security interests, creating potential channels for sensitive information flow across international boundaries, shielded by technical and financial legalities. The crucial pattern involves the simultaneous existence of dual customer bases: one serving Western law enforcement and another allegedly serving Russian intelligence apparatuses. This connection is not merely about ownership but about embedding forensic capability within systems that cross geopolitical lines, as evidenced by the parallel control over both commercial sales and government applications in multiple jurisdictions simultaneously.
The mechanism appears to be the use of ostensibly neutral, EU-funded research frameworks to develop and disseminate tools, which then serve dual purposes: enhancing legitimate investigative capacity in Europe while potentially serving state security objectives abroad. The concern is less about a single illicit transaction and more about the persistence of access—the alleged use of Russian-developed technology on data that may later be relevant to EU criminal evidence, as suggested by the Civil Society Group's concerns regarding FSB/Investigative Committee involvement in EU databases.
This complexity forces a recognition that technical compliance (e.g., project funding status) does not equate to ethical or security neutrality. The pattern suggests that focusing solely on jurisdictional funding gaps risks overlooking the continuous functional application of these tools by state actors, regardless of formal affiliations. What is being obscured is the long-term consequence of embedding such dual-use technology into law enforcement infrastructure, potentially creating an asymmetrical advantage for those controlling the technology over the entities using it.
Bridge Questions: If a tool's legal provenance is obfuscated to facilitate its use by multiple state actors, how should oversight mechanisms be restructured to assess the risk posed by technology transfer rather than just funding sources? What frameworks are necessary to address the potential compromise of EU judicial processes when forensic tools originate from jurisdictions with known security concerns? Does the focus on immediate access to evidence outweigh the long-term risk associated with data collection methodologies rooted in potentially adversarial systems?