Met Police pauses Oxygen Forensics software over Russian-ownership allegations

London's Metropolitan Police has paused its use of digital forensics software from Oxygen Forensics amid US allegations the supposedly American vendor was secretly owned by Russians and had its software built in Moscow.

Scotland Yard confirmed the suspension and a "full review" after US prosecutors last week accused Oxygen CEO Lee Reiber and Russian national Oleg Davydov of hiding who owned the company and where its software was written. The Met signed a three-year deal with Oxygen in December 2023; forensics teams use it to pull data from phones and other devices seized in investigations.

What the Met says

"We have paused our use of the tool while we carry out a full review," a Met spokesperson told The Times. "At this time, we believe any impact to ongoing investigations will be extremely limited." The force added it does not share investigation data with Oxygen Forensics Inc.

The force says the software runs on a closed, offline IT system and was used in fewer than 0.2 percent of more than 23,000 actions carried out by its digital forensics teams over the past year.

The DOJ allegations

The US Department of Justice alleges that Oxygen, based in Alexandria, Virginia, posed as an independent US company while being owned and controlled by five Russian nationals through a holding company in Cyprus.

Prosecutors claim the same five Russians also owned Moscow-based MKO Systems, formerly Oxygen Software, where developers actually wrote the code. MKO sold the technology in Russia under different product names to customers reported to include the FSB.

US defense and homeland security agencies also bought the software, including Homeland Security Investigations and the DHS Office of Inspector General. The DOJ is not alleging that the software contained malicious code or was used to gain unauthorized access to customer systems or data.

Arrest and extradition case

Davydov, 52, was arrested at London's Heathrow Airport last month while preparing to fly to Turkey and appeared at Westminster Magistrates' Court on Tuesday as the US seeks his extradition. According to The Times, District Judge Anthony Calloway declined bail, citing Davydov's Russian citizenship and residence and the risk that he could flee.

Fallout beyond London

The fallout is not limited to the Met. The National Police Chiefs' Council said other UK forces using Oxygen products have been encouraged to carry out their own assessments. "These remain allegations at this stage," an NPCC spokesperson said, noting that US authorities have stated they are not alleging malicious code or unauthorized access to customer data.

Romanian authorities have begun winding down their use of Oxygen products, while Latvia's State Police has suspended the software pending an assessment. The Register contacted the Met, the NPCC and Oxygen Forensics for comment.