Russian spy firm infiltrated police forces across Europe

Full text

BRUSSELS — A U.S.-based data-extraction firm accused of being secretly run from Russia has worked on EU-backed projects and sold its services to European law enforcement agencies, according to documents seen by POLITICO.

The U.S. Justice Department last week charged Oxygen Forensics — officially headquartered in Virginia — of concealing that it was actually owned and operated by Russians. The company develops and sells powerful software capable of extracting and analyzing information from smartphones and computers, a process known as “digital forensics.”

According to public records reviewed by POLITICO, Oxygen was used in at least two EU-funded projects aimed at improving how electronic evidence is collected, processed and shared in criminal investigations.

The first project, EVIDENCE, (European Informatics Data Exchange Framework for Courts and Evidence), which received more than €1.9 million in EU funding between 2014 and 2016, listed Oxygen Forensics among the companies consulted on how Europe could better handle and exchange digital criminal evidence. That placed the company in a wider network that included EU police agency Europol, judicial cooperation agency Eurojust and the European Anti-Fraud Office’s digital forensics unit.

The second project, INSPECTr, backed under Horizon 2020, an EU research and innovation funding arm, was designed to help European police bring together and analyze digital evidence collected using different tools. It built software that could take evidence extracted with Oxygen Forensics and make it easier for investigators using other systems to access and analyze it.

Although both of those EU-backed projects were launched well before Russia’s February 2022 full-scale invasion of Ukraine and subsequent European sanctions, INSEPCTr continued to operate until 2023. Oxygen also currently remains listed on the websites of both projects. On its own now-defunct website, Oxygen Forensics had listed the European Commission as a client.

A Commission spokesperson stressed that Oxygen Forensics was not a member of either consortium, “and hence did not receive funding under these projects from the Commission.” The spokesperson, who was granted anonymity to speak freely about a sensitive topic, said EU-funded projects are subject to strict eligibility and ethics standards, and “since the beginning of the Russian war of aggression against Ukraine, Russian-based entities cannot participate in Horizon Europe projects in any capacity.”

Sister company’s FSB link

More recently, after its involvement with the EU-backed projects, Oxygen’s products have been accredited and purchased by multiple national police agencies across Europe, including those in Germany, Spain, Italy and Poland, according to notices in the EU tender database.

A statement published Wednesday by the U.S. Justice Department found Oxygen Forensic’s software was developed and managed by a team in Russia under the direction of Russian national Oleg Sergeyevich Davydov, but purported to be led by Lee Reiber, a 55-year-old native of Boise, Idaho. An affidavit filed with the complaint says Oxygen Forensics was in contact with the U.S. Department of War and several parts of the Department of Homeland Security, including the Secret Service, its digital-forensics training institute, Homeland Security Investigations and the department’s internal watchdog.

Reiber has since been arrested in the U.S. Davydov was arrested Sunday at London’s Heathrow Airport as he prepared to board a flight to Istanbul, according to a statement by the Justice Department. Lawyers for the two men did not respond to POLITICO’s request for comment.

Representatives for Oxygen Forensics did not respond to requests for comment either. In the meantime, the company’s website has been seized by the U.S. government.

Prosecutors allege that after Washington imposed sanctions on Russia in 2022, Oxygen’s Russian owners concealed both their ownership and the continued development of the company’s software in Russia. The five Russians behind Oxygen Forensics also controlled a Russian sister company, MKO Systems, that sold the same underlying technology to the Russian Security Service (FSB) and the country’s Interior Ministry.

The Justice Department complaint does not allege that Oxygen’s software contained malicious code or that the company used it to gain unauthorized access to customers’ systems or data. U.S. investigators did, however, seize corporate bank accounts, 57 domains and other cyber infrastructure they said was “used in furtherance of the alleged acts.”

Used across Europe

Oxygen’s footprint extends beyond the Commission-backed research projects. The French investigative news organization, Disclose, found its surveillance software was supplied to Moroccan authorities under an EU-funded border-management program for the Maghreb. As well as financing the purchase of the software, the EU also funded training courses led by employees of Oxygen Forensics for Moroccan police.

The company has listed major European law-enforcement bodies among its customers.

In Hungary, a government procurement document shows that the Hungarian police signed an IT contract in Dec. 2024 with Oxygen Forensics worth 10.14 million Hungarian forints (€27,000) which ran through Dec. 2025.

In Italy, an April 2026 technical brief issued by the Public Prosecutor’s Office in the Sardinian city of Sassari explicitly lists Oxygen Forensics among the recognized systems that judicial police can use to extract and analyze data from mobile devices.

And in Spain, a 2026 study on digital analysis of WhatsApp on Android and Apple smartphones was produced by a National Police inspector accredited by Oxygen Forensics and involved in training police investigators in digital analysis.

Law enforcement agencies in Romania and Latvia also bought its software, as recently as September.

None of the national police agencies involved responded to requests for comment.

Natalia Krapiva, senior legal counsel at digital rights group Access Now, said civil society organizations had warned for years about Oxygen Forensics’ Russian ownership and development links, which she said have now been corroborated by the U.S. case.

“If in fact Russian-made software designed for the FSB and Investigative Committee was used for handling EU Commission criminal evidence database, it raises a serious possibility of sensitive information being compromised and accessed by Russian authorities,” Krapiva said.

“We call on the EU and every government using these tools to suspend them and fully investigate how a Russian-owned company spent a decade inside Western law enforcement.”