Met Police Suspends Oxygen Forensics Software Over Russian Ownership Allegations

Key Points

• The Metropolitan Police has paused its use of Oxygen Forensics digital forensics software and ordered a full review following allegations by US prosecutors concerning the company’s ownership and software development.
• According to The Register, journalist Carly Page reported that the Met had used Oxygen tools to extract and analyse information from seized phones and other electronic devices.
• The Met signed a three-year agreement with Oxygen Forensics in December 2023, but the force said the software accounted for less than 0.2% of more than 23,000 digital-forensics actions during the past year.
• The Metropolitan Police said the software operated on a closed IT system that was not connected to the internet and said it did not share investigation data obtained through the software with Oxygen Forensics.
• The US Department of Justice alleges that Oxygen Forensics was presented as an independent US company despite being owned and controlled by five Russian nationals through a Cyprus-based holding company.
• US prosecutors also allege that the company’s software was developed in Russia by a Moscow-based operation formerly known as Oxygen Software and now called MKO Systems.
• The same Russian operation allegedly supplied technology in Russia to organisations including the Federal Security Service, the Russian Investigative Committee and the Ministry of Internal Affairs.
• The US allegations do not claim that Oxygen’s software contained malicious code or was used to obtain unauthorised access to customer systems or data.
• Oxygen CEO Lee Reiber and Russian national Oleg Sergeyevich Davydov have been charged in the United States with conspiracy to commit wire fraud, according to the US Department of Justice.
• Davydov was arrested at Heathrow Airport and is facing proceedings connected with a US extradition request.
• The National Police Chiefs’ Council has encouraged UK forces using Oxygen products to conduct proportionate local assessments.
• Authorities in Romania and Latvia have also taken steps to review or suspend their use of Oxygen products.

Mosco News Daily (MND) October 2, 2026 – The Metropolitan Police has suspended its use of digital forensics software supplied by Oxygen Forensics while it carries out a full review following allegations by US prosecutors that the company concealed Russian ownership and the location where its software was developed. The Met said it believes the effect on ongoing investigations will be extremely limited, noting that the software was used in fewer than 0.2% of more than 23,000 digital-forensics actions during the previous year. The force also said the software operated on a closed system without an internet connection and that investigation data was not shared with Oxygen Forensics.

Why has the Metropolitan Police suspended Oxygen Forensics software?

The Metropolitan Police’s decision follows criminal allegations brought by US authorities against Oxygen Forensics chief executive Lee Reiber and Russian national Oleg Sergeyevich Davydov.

As reported by Carly Page of The Register on October 2, Scotland Yard confirmed that it had stopped using Oxygen’s tools while conducting a “full review”. The software forms part of digital-forensics work in which investigators extract and analyse information from mobile phones and other devices obtained during investigations.

The Times also reported that the Met had suspended the software after US prosecutors disclosed allegations concerning the company’s links to Russia. The newspaper reported that Oxygen products had been used by UK police forces, including specialist units within the Metropolitan Police.

The issue is therefore not based on an allegation that the Met itself knowingly obtained technology from a Russian-controlled operation. Rather, the immediate concern arises from claims made by US prosecutors about Oxygen’s corporate ownership, management and development arrangements.

The Metropolitan Police has said that its own review is under way.

What did the Metropolitan Police say about the potential effect on investigations?

According to The Register, a Metropolitan Police spokesperson said the force had paused use of the tool while carrying out its review and believed that any effect on ongoing investigations would be “extremely limited”. The Met also said it did not share investigation data obtained through the software with Oxygen Forensics.

The force said the Oxygen software operated on a closed IT system that was not connected to the internet.

The Met further stated that the software had been involved in fewer than 0.2% of the more than 23,000 actions carried out by its digital-forensics team during the previous year. This figure was given by the force to place the current suspension in the context of its wider digital-forensics activity.

That distinction is significant because the US Department of Justice has not alleged that Oxygen software itself contained malicious code.

The department also has not alleged that the software was used to gain unauthorised access to customers’ systems or data.

Consequently, the current review concerns the allegations surrounding the company’s ownership and development arrangements as well as any implications those allegations could have for organisations that purchased or used the technology.

What are US prosecutors alleging about Oxygen Forensics?

The US Department of Justice announced on September 23 that Reiber and Davydov had been arrested in connection with a federal criminal complaint alleging that they concealed Russian ownership and Russian development of software supplied to US government agencies.

According to the department, Oxygen Forensics is based in Alexandria, Virginia, but prosecutors allege that five Russian nationals owned and controlled the company through a Cyprus-based holding company.

The same five individuals allegedly owned a Russian company formerly known as Oxygen Software and now called MKO Systems.

The Department of Justice alleges that software sold by Oxygen Forensics to US government customers was developed by a team working in Russia under Davydov’s direction.

The allegations relate to the period after the United States expanded sanctions against Russia following Russia’s invasion of Ukraine in 2022.

The US complaint alleges that Reiber became Oxygen’s chief executive, president and chairman in March 2022 while the Russian owners were removed from public corporate filings.

Prosecutors nevertheless allege that the Russian owners continued to exercise significant control, including making important decisions, setting Reiber’s compensation, overruling decisions concerning payments and retaining authority over company bank accounts.

These claims remain allegations contained in a criminal complaint. The US Department of Justice has explicitly stated that defendants are presumed innocent unless proven guilty beyond a reasonable doubt.

Where was the Oxygen software allegedly developed?

The central allegation concerns a distinction between Oxygen Forensics’ US corporate presence and the location where prosecutors say its software was actually developed.

The Department of Justice alleges that the software was written and managed by a Russian team under Davydov’s direction.

Prosecutors say the development operation was associated with MKO Systems, a Moscow-based company previously known as Oxygen Software. According to the allegations, that operation supplied technology in Russia under different product names.

The customers reportedly included Russia’s Federal Security Service, commonly known as the FSB, as well as the Russian Investigative Committee and the Russian Ministry of Internal Affairs.

The Register’s Carly Page reported that the same Russian operation was alleged to have supplied technology to Russian security bodies while Oxygen Forensics sold its products to US government agencies.

The significance of the allegation lies in the claimed difference between the company’s US-facing corporate identity and its alleged ownership and development structure.

However, it is important to distinguish those allegations from claims that the software itself was malicious. The Justice Department has not alleged that Oxygen’s products contained malicious code or were used to access customer systems without authorisation.

Which US government agencies used Oxygen Forensics products?

The allegations have attracted attention partly because Oxygen Forensics had government customers in the United States.

The Register reported that US defence and homeland-security organisations had purchased the company’s digital-forensics technology. These included Homeland Security Investigations, the Department of Homeland Security’s Office of Inspector General and the Secret Service’s National Computer Forensics Institute.

The Department of Justice said the National Computer Forensics Institute awarded Oxygen a five-year contract in September 2024.

According to prosecutors, the contract followed an October 2023 certification in which Reiber allegedly stated that the company had no immediate or highest-level owner. The Justice Department alleges that this certification did not reflect the company’s actual ownership arrangements.

The department further alleges that Oxygen made statements in 2024 concerning foreign control of the company and that Reiber told US officials in March 2026 that Russians were not involved in developing the software.

Prosecutors allege that the software was nevertheless being developed and managed in Russia.

What happened to Oleg Davydov after his arrest in London?

Oleg Sergeyevich Davydov, a 52-year-old Russian national, was arrested at Heathrow Airport in September while preparing to travel to Istanbul.

The US authorities said they expected to seek his extradition to the United States.

The case subsequently moved into the UK courts.

As reported by The Times, Davydov appeared at Westminster Magistrates’ Court as US authorities pursued his extradition. The newspaper reported that District Judge Anthony Calloway declined to grant bail, citing concerns related to Davydov’s Russian citizenship and residence and the possibility that he could leave the jurisdiction.

The Register separately reported that a clerk at Westminster Magistrates’ Court said Davydov had been refused bail because the court had not had enough time to gather important information.

The two reports describe the same bail decision from different perspectives, while the extradition process remains separate from the underlying US criminal allegations.

The Department of Justice said Davydov’s extradition was expected to be pursued through the appropriate international legal process.

What has the National Police Chiefs’ Council said?

The implications extend beyond the Metropolitan Police because other UK police forces also use Oxygen products.

The National Police Chiefs’ Council said it was aware of the allegations made by US authorities.

As reported by The Register, an NPCC spokesperson stressed that the claims remained allegations and noted that US authorities had not alleged that the software contained malicious code or that customer data had been accessed without authorisation.

The NPCC has encouraged forces using Oxygen products to conduct proportionate local assessments.

The assessments are intended to help individual forces understand their use of the products and identify and contain any issues that may emerge.

This approach means the Met’s decision does not automatically amount to a finding that Oxygen software compromised police investigations or data. Instead, individual organisations are being asked to assess their own circumstances in light of the US allegations.

Have other European authorities suspended Oxygen software?

The issue has also spread beyond the UK.

According to The Register, Romanian authorities have begun terminating their use of Oxygen products, while Latvia’s State Police has suspended the software while it conducts an assessment.

The wider European response reflects the fact that Oxygen products have been used by law-enforcement and digital-forensics organisations in multiple countries.

The developments also demonstrate that the questions raised by the US case concern more than one individual police force. Organisations using the software must now establish how the products were supplied, where they were developed, what corporate entities were involved and what safeguards existed around data and network access.

What does the US case say about Oxygen’s corporate structure?

The Justice Department’s complaint provides a detailed account of the alleged corporate structure.

According to federal prosecutors, five Russian nationals controlled Oxygen Forensics through a Cyprus-based holding company while the company presented itself to US government customers as an independent American organisation.

The Justice Department alleges that public corporate filings did not fully reflect the Russian ownership after 2022.

Prosecutors also allege that Russian owners continued to exercise control behind the scenes despite their removal from public filings.

The department says authorities have also seized corporate bank accounts, approximately 57 domains and other cyber infrastructure allegedly connected to the conduct under investigation.

Reiber and Davydov face a charge of conspiracy to commit wire fraud. The statutory maximum penalty cited by the Justice Department is 20 years in federal prison if convicted, although any eventual sentence would depend on the court and applicable law.

The criminal complaint itself does not establish guilt. The allegations must be tested through the judicial process.

Why is the case significant for police digital forensics?

Digital forensics has become an important part of modern criminal investigations because police routinely need to examine information stored on mobile phones, computers and other electronic devices.

Software used for this purpose can form part of the technical chain through which investigators acquire, extract and analyse digital evidence.

The current case raises questions about procurement, ownership transparency and software-development locations rather than establishing that the Met’s evidence has been compromised.

The Met’s statement that the software operated on a closed system and was used in less than 0.2% of its digital-forensics actions is therefore relevant to assessing the immediate operational implications.

At the same time, the National Police Chiefs’ Council’s recommendation for local assessments indicates that individual forces are expected to consider their own use rather than assume that the circumstances are identical across all organisations.

What happens next for the Metropolitan Police?

The immediate next step is the Met’s full review of Oxygen Forensics software.

The force has not announced that existing investigations using the software are invalid. Instead, it has said that it believes the impact on ongoing investigations will be extremely limited.

The review is expected to provide the force with an opportunity to assess its contractual arrangements, technical safeguards and previous use of the product in digital-forensics operations.

The wider police response will depend partly on the findings of individual force assessments and developments in the US criminal proceedings.

The Department of Justice investigation is being conducted with assistance from US agencies including the Bureau of Industry and Security and the Department of War Office of Inspector General Defense Criminal Investigative Service, while the Justice Department’s Office of International Affairs is involved in the extradition process concerning Davydov.

What is the background to the Oxygen Forensics controversy?

Oxygen Forensics was established in the United States and developed technology designed for digital investigations and forensic examination of electronic devices.

The US criminal case centres on allegations that the company’s public American identity concealed Russian ownership and that its software-development activities remained in Russia.

The Justice Department says Davydov helped establish Oxygen Forensics in Virginia in 2013 and served as the Russian company’s chief technology officer, with responsibility for software development. Reiber joined the company in 2015.

According to prosecutors, the ownership and development arrangements became particularly significant after the United States imposed expanded sanctions against Russia in 2022.

The allegations that followed led to arrests in the United States and United Kingdom, seizure of corporate infrastructure and scrutiny from government agencies and law-enforcement bodies that had used Oxygen products.

The Department of Justice has made clear that its complaint contains allegations rather than established findings of guilt. It has also specifically said the case does not allege malicious code in the software or unauthorised access to customer systems or data.

What could the development mean for UK police forces?

For UK police forces, the immediate effect is likely to centre on software assurance, procurement checks and assessments of existing digital-forensics arrangements rather than any established finding that investigations have been compromised.

The NPCC has already encouraged forces using Oxygen products to conduct proportionate local assessments.

The Metropolitan Police’s statement that Oxygen was used in less than 0.2% of more than 23,000 digital-forensics actions provides a specific indication of the scale of its use within the force during the period cited.

Other forces may have different contracts, technical configurations and levels of reliance on Oxygen products, meaning their assessments could produce different conclusions.

For police investigators, prosecutors and courts, any review of previous use could also require careful consideration of how digital evidence was obtained and processed. However, the available information does not establish that evidence generated using Oxygen software is unreliable or that customer data was unlawfully accessed.