The Metropolitan Police has halted its use of digital forensics software from Oxygen Forensics while investigating US allegations that the company, despite presenting itself as American, was secretly controlled by Russian nationals and developed its products in Moscow. Scotland Yard confirmed the suspension and launched a full review after US prosecutors last week charged Oxygen CEO Lee Reiber and Russian citizen Oleg Sergeyevich Davydov with hiding the firm's true ownership structure and development location. The force's digital forensics teams have been using Oxygen's tools to pull data from phones and other devices taken during criminal cases since signing a three-year contract in December 2023.
The Met's use of the software was relatively limited, accounting for fewer than 0.2 percent of the more than 23,000 tasks its digital forensics unit completed over the past year. The tool operated on an isolated IT system with no internet connection, and Scotland Yard said it never shared any investigative data with Oxygen Forensics Inc. US prosecutors allege that five Russian nationals owned and ran Oxygen through a Cyprus-based holding company, despite the firm being headquartered in Alexandria, Virginia and marketing itself to American government clients as an independent US business. Those same five Russians also allegedly controlled MKO Systems, a Moscow-based company formerly called Oxygen Software, where developers actually wrote the forensics software code.
According to the US Department of Justice, MKO sold the technology inside Russia under different brand names to customers including the Federal Security Service, known as the FSB, along with the Russian Investigative Committee and Ministry of Internal Affairs. Prosecutors have not alleged that Oxygen's software contained harmful code or was exploited to gain unauthorized entry to customer systems or data. Davydov, 52, was arrested at London's Heathrow Airport last month as he prepared to board a flight to Turkey and appeared at Westminster Magistrates' Court on Tuesday as the US pursues extradition. District Judge Anthony Calloway denied bail, citing Davydov's Russian citizenship and residence and the possibility he might flee, though a court clerk said bail was refused because officials "hadn't had enough time to gather important information."
The fallout is rippling across multiple countries as law enforcement agencies reassess their relationships with Oxygen products. The National Police Chiefs' Council confirmed that other UK forces also deploy Oxygen tools and have been urged to conduct their own evaluations, while Romanian authorities have started discontinuing their use of the software and Latvia's State Police has suspended it pending assessment. The Met said it expects any impact on active investigations to be extremely limited. For security leaders in both public and private sectors, the episode highlights how supply chain opacity can create unintended exposure even when the technology itself functions exactly as advertised. When geopolitical concerns intersect with critical tools, organizations face the uncomfortable choice between operational continuity and reputational risk, regardless of whether any actual compromise occurred.