Met Police pauses Oxygen Forensics phone tool after US Russia charges

Scotland Yard confirmed it has paused its use of Oxygen's tools and launched what it calls a "full review."

"We have paused our use of the tool while we carry out a full review. At this time, we believe any impact to ongoing investigations will be extremely limited. The Met does not share any data obtained from investigations with Oxygen Forensics Inc."

That's a Met spokesperson, speaking to The Times. The force signed a three-year deal with Oxygen in December 2023. Its digital forensics teams used the software to extract and analyze data from phones and other devices seized during investigations.

By the numbers: the Met says the software was used in less than 0.2% of the more than 23,000 actions its digital forensics team carried out over the past year. It also says the tool runs on a closed IT system that isn't connected to the internet.

The story starts in the US. The Justice Department announced on Wednesday, September 23 that it had arrested two men tied to the company:

• Lee Reiber, 55, of Boise, Idaho, Oxygen's CEO. He was arrested in Idaho and released on bond.
• Oleg Sergeyevich Davydov, 52, of Moscow. He was arrested at London Heathrow Airport before boarding a flight to Istanbul.

Both are charged with conspiracy to commit wire fraud, which carries up to 20 years in prison, The Record reports.

The core allegation: Oxygen, based in Alexandria, Virginia, presented itself to the US government as an independent American company. Prosecutors say that in fact, five Russian nationals, including Davydov, owned and controlled it through a holding company in Cyprus, and its software was developed in Russia.

Prosecutors say the same five Russians also owned MKO Systems, a Moscow company previously known as Oxygen Software, where the code was actually written. MKO sold the same technology in Russia under different product names, The Register reports, to customers including the Federal Security Service (FSB), the Russian Investigative Committee and the Ministry of Internal Affairs.

According to the Justice Department, the scheme began after the US expanded sanctions on Russia following its invasion of Ukraine in early 2022.

• March 2022: Reiber became the company's CEO, president and chairman of the board. Russian names were then removed from Oxygen's corporate filings, prosecutors say.
• Behind the scenes: the press release says the Russian owners kept making significant decisions, set Reiber's pay, overruled him on payments and held signing authority over the company's bank accounts.
• December 2022 and October 2023: Reiber falsely certified to the US government that Oxygen had no immediate or highest-level owner, according to the affidavit.

In November 2023, a reporter asked Reiber about the company's Russian ties. Prosecutors say he then wrote to Davydov and two other Russian owners that public reporting "could destroy this entire opportunity," meaning a pending contract with the National Computer Forensics Institute.

That institute, run by the Secret Service, signed a five-year deal with Oxygen in September 2024, The Record reports. On September 20 this year, US authorities seized about 57 domains, along with cyber infrastructure and corporate bank accounts belonging to the firm.

Oxygen's US customer list was serious. According to the Justice Department, buyers included the Defense Department and several parts of Homeland Security:

• The Secret Service's National Computer Forensics Institute
• Homeland Security Investigations
• The DHS Office of Inspector General

The Record reports the firm has nearly 10,000 contracts in more than 150 countries, and describes it as a direct competitor of Cellebrite, the better-known phone forensics company.

In Europe, Politico reported that police in Germany, Spain, Italy and Poland accredited or bought Oxygen's products, according to EU tender records, as summarized by Security Affairs. Hungary's police signed a contract worth about €27,000 in December 2024. Politico also found Oxygen was consulted on two EU-funded digital evidence projects, though the European Commission says the company was not a formal member and got no direct EU funding.

The catch: nobody has alleged that the tool was booby-trapped.

The Justice Department says it is not alleging that Oxygen's software contained malicious code or was used to get unauthorized access to customer systems or data. The case is about who owned the company and what it told government buyers, not about hidden spyware.

The UK's National Police Chiefs' Council made the same point. "These remain allegations at this stage," a spokesperson said, adding that US authorities have stated they are not alleging the software contained malicious code or that customer data was accessed without authorization.

Digital rights groups see a wider risk. Natalia Krapiva, senior tech legal counsel at Access Now, told The Record that "no surveillance tool should come anywhere near a US investigation until we know who owns it, who builds it, and who else they are selling to." She also said the same software sold to US law enforcement was used by the FSB to pull data off the phones of anti-war Russians.

The fallout is spreading beyond Scotland Yard.

• Other UK forces: the National Police Chiefs' Council says forces that use Oxygen products have been encouraged to carry out "proportionate local assessments" to understand and contain any issues.
• Romania: authorities have begun ending their use of Oxygen products, The Register reports.
• Latvia: the State Police has suspended the software pending an assessment.
• Davydov: he appeared at Westminster Magistrates' Court on Tuesday as the US seeks his extradition. District Judge Anthony Calloway refused bail, citing his Russian citizenship and residence and the risk that he could flee, The Times reports.

The Register says it contacted the Met, the National Police Chiefs' Council and Oxygen Forensics for comment. Oxygen's own website has been seized and is down, The Record reports.

For another recent look at the phone forensics business, see our story on GrayKey and the iPhone's Inactivity Reboot.

In real life If police seize a phone in a UK investigation, specialist teams copy and examine its data with tools like these. The Met says Oxygen played a very small part in that work and never received any case data.

• If you're in the UK: the Met says the impact on ongoing cases should be extremely limited, and that no investigation data went to Oxygen.
• No malware claim: prosecutors are not alleging the tool spied on anyone or contained malicious code.
• Watch for more pauses: other UK forces and European agencies are reviewing their own use, so more suspensions are possible.
• Nothing is proven yet: the US case is a criminal complaint, and the charges are allegations until a court rules.