Why Oxygen Forensics US tech CEO selling software to Europe agencies was arrested

US prosecutors say an American forensic tool concealed its Russian owners and its development in Russia. Used by numerous security agencies in Europe, Oxygen Forensics helps investigators worldwide access data from mobile phones and computers. Many bodies are now suspending use of the software following recent revelations. The Slovak interior ministry bought the software in 2018 when links to Russia were not yet publicly known, then renewed the license multiple times. Now, the ministry said IT department officials are investigating the issue. The tool was also sold to other government bodies across Europe. Russian ownership via Cyprus In the US, Virginia-based Oxygen Forensics CEO Lee Reiber was arrested at the end of September, along with Oleg Davydov, one of the Russian owners. The company was headquartered in the US state of Virginia, appearing American. According to federal prosecutors in the US, the company hid its Russian ownership through a shell company in Cyprus and that its software was developed in Russia. Allegedly, this scam helped secure contracts for the forensic tool in the US, UK, Czech Republic, Latvia, Romania, and Slovakia. Reiber, a 55-year-old American, was arrested in Idaho on Sunday. On Tuesday (22 September), he appeared before a federal court there and was released on bail. He is expected to appear before a federal court in Los Angeles soon. Davydov, a 52-year-old from Moscow, was arrested on that same day at London Heathrow before he could board a flight to Istanbul. And the US plans to seek extradition. Both face charges of conspiracy to commit wire fraud. The group of five also owned a Russian company co-founded by Davydov in 2000. Until September 2022, it was called Oxygen Software and now operates under the name MKO Systems. Its programmers worked in Russia, where the company sold the software under other names. According to investigative files, its clients included Russia's secret service (FSB), investigative committee (SKR) and interior ministry. Davydov, the company's technical director, was responsible for software development. In 2013, he helped establish Oxygen Forensics in Virginia with Reiber joining the company in August 2015. Prosecutors say that following Russia's full-scale invasion of Ukraine and US sanctions after, the duo agreed to hide both the real owners and that it was developed in Russia. In March 2022, Reiber became CEO and director. Then, Russian owners were removed from public company records. However, investigators said the Russians continued to control the company, making key decisions, determining Reiber's pay, and outvoting him on the board. The charges concern the concealment of the software's ownership and origin in securing public contracts. A network of deception Two companies were found to have supplied the Slovak interior ministry with Oxygen Forensic tools. In 2018, the sale was part of a broader procurement by the ministry for computers, laptops, servers, monitors and printers, ordered from the Czech company Risk Analysis Consultants for €125,000, the forensic tool itself costing €10,000. The Prague-based company did not respond for comment. Screenshot of order from 2018 (Source: Slovak interior ministry website) An invoice issued to the Slovak interior ministry in 2022 by the Slovak company Microcomp–Computersystém indicates the renewal of a licence for this software. At the time, the minister responsible was Roman Mikulec. Screenshot of invoice from 2022 (Source: Slovak interior ministry website) The Slovak ministry also ordered a licence renewal in July 2024, under his successor Matúš Šutaj Eštok. Microcomp–Computersystém did not respond for comment. Interior ministry order with links to Russia. (Source: Slovak interior ministry website) Authorities warned On Friday (2 October), the Slovak national security authority (NBÚ) warned of the risks posed by using software from Oxygen Forensics and connected companies such as MKO Systems and Prostranstvo IT. Their software helps investigators search for and examine data from digital devices. It can process vast amounts of information, including evidence, which makes it important who owns, controls and develops it. According to the NBÚ, this is important both for data protection and for the reliability of analysis results. The warning came after the US case was made public. The NBÚ considers links to Russia significant in assessing the security risk, also in view of Russia's military aggression against Ukraine. However, the warning itself does not mean that data leaked through the software. US prosecutors explicitly stated that the charges did not concern malicious code or unauthorised access to customer data. The case concerns the alleged concealment of the software's ownership and origin. And no court has yet ruled on the case. “The ministry will proceed in accordance with the recommendations of the National Security Authority,” the Slovak interior ministry said. The NBÚ recommended that public bodies identify this company's presence and report it to the authority. Belgian Green MEP Saskia Bricmont also called for the use of Oxygen to be stopped immediately and for an inquiry into whether sensitive information could have reached Russia after it was found that Romania, Germany, Spain, Italy, Poland and Hungary had purchased the software. European police shed tool Several European security agencies are suspending the use of Oxygen Forensics software or taking steps to terminate their contracts after the company's Russian ties came to light. The tool was also used by Czech police. Czech security agencies continued to purchase licences for the computer software after 2022, when the full-scale invasion of Ukraine began. Czech authorities are awaiting further information from the United States. For now, they have prohibited software updates. London's Metropolitan Police has suspended the use of Oxygen tools and launched a comprehensive review. British police forces, including specialised units, had used the software. And Latvian police suspended its use and is assessing whether it will continue using it. Romania's anti-corruption agency, too, took steps to terminate its contract with the Russia-linked tool.