The Metropolitan Police has stopped using digital forensics software from Oxygen Forensics while it investigates US allegations that the supposedly American outfit was secretly owned by Russians and developing its wares in Moscow. Scotland Yard confirmed it has paused use of the company's tools and launched a "full review," after US prosecutors last week accused Oxygen CEO Lee Reiber and Russian national Oleg Sergeyevich Davydov of concealing the company's ownership and where its software was actually being built.
The Met signed a three-year deal with Oxygen in December 2023. Digital forensics teams use its software to extract and analyze data from phones and other devices seized during investigations. "We have paused our use of the tool while we carry out a full review," a Met spokesperson told The Times.
"At this time, we believe any impact to ongoing investigations will be extremely limited. The Met does not share any data obtained from investigations with Oxygen Forensics Inc." The force said Oxygen's software runs on a closed IT system that isn't connected to the internet and was used in less than 0.
2 percent of the more than 23,000 actions carried out by its digital forensics team over the past year. The pause comes after the US Department of Justice alleged that Oxygen, which is based in Alexandria, Virginia, presented itself to US government customers as an independent American company despite being owned and controlled by five Russian nationals through a Cyprus-based holding company.
Prosecutors claim the same five Russians also owned Moscow-based MKO Systems, previously known as Oxygen Software, where developers actually wrote Oxygen's software. MKO, meanwhile, sold the technology in Russia under different product names to customers reportedly including the Federal Security Service, better known as the FSB, as well as the Russian Investigative Committee and Ministry of Internal Affairs.
Oxygen's US customers weren't exactly small fry. US defense and homeland security agencies bought its software, including Homeland Security Investigations, the DHS Office of Inspector General, and the Secret Service's National Computer Forensics Institute. The DoJ isn't alleging that Oxygen's software contained malicious code or was used to gain unauthorized access to customer systems or data.
Davydov, 52, was arrested at London's Heathrow Airport last month while preparing to fly to Turkey and appeared at Westminster Magistrates' Court on Tuesday as the US seeks his extradition. District Judge Anthony Calloway declined to grant bail, according to The Times, citing Davydov's Russian citizenship and residence and the risk that he could flee. A clerk at Westminster Magistrates' Court told The Register that Davydov, was refused bail because it "hadn’t had enough time to gather important information."
The fallout isn't limited to Scotland Yard. The National Police Chiefs' Council said other UK forces also use Oxygen products and have been encouraged to carry out their own assessments. "We are aware of the allegations made by US authorities regarding Oxygen Forensics," an NPCC spokesperson said.
"These remain allegations at this stage and we note that US authorities have stated they are not alleging the software contained malicious code or that customer data was accessed without authorisation." "Forces that use Oxygen products have also been encouraged to undertake proportionate local assessments and activity to understand and contain any issues that are identified," the spokesperson added.
The allegations are causing headaches elsewhere in Europe too. Romanian authorities have begun terminating their use of Oxygen products, while Latvia's State Police has suspended the software pending an assessment. The Register contacted The Met, NPCC and Oxygen Forensics for comment.
Originally published at theregister.com
