The Royal Canadian Mounted Police have purchased software from a digital forensics software company that U.S. authorities claim is secretly headquartered in Russia.
Open this photo in gallery:
Publicly available procurement data show that the RCMP paid Oxygen Forensics almost $34,000 in licensing fees this January for a contract that is active until the end of this year.ETHAN CAIRNS/The Canadian Press
Oxygen Forensics presented itself as an American firm to land contracts with the U.S. government, when it was in fact controlled by Russian nationals via a Cypriot shell company, according to a criminal complaint filed by the U.S. Justice Department in late September.
Oxygen Forensics is tied to a Russian software development company that counts Russian security services amongst its clients, the complaint alleges.
Earlier this week, the German-owned media outlet Politico reported that several European law enforcement agencies, including London’s Metropolitan Police, have suspended their use of Oxygen Forensics’ software, which allows investigators to collect and extract data from digital devices, in the wake of the allegations.
U.S. prosecutors have not alleged that Oxygen Forensics’ software contained malicious code or that it was used to gain unauthorized access to clients’ computer systems or data.
Publicly available Canadian procurement data show that the RCMP paid Oxygen Forensics almost $34,000 in licensing fees this January for a contract that is active until the end of 2026.
The national law enforcement agency previously signed a $65,000 contract with the company, which is described in procurement documents as a U.S.-based vendor, in 2024.
Court records from that year show the RCMP used the company’s software in a New Brunswick murder investigation to “validate data” on a suspect’s cellphone.
The Canadian Department of Defence also spent $20,000 on Oxygen Forensics software in 2015, which predates the time period when U.S. prosecutors allege the firm’s leadership conspired to dupe clients by concealing the company’s ownership amid increasingly strict economic sanctions against Russia.
A spokesperson for the Vancouver Police Department, Constable Darren Wong, confirmed to The Globe and Mail that the police force also previously held one Oxygen Forensics software licence, which typically permits use on a single computer by one user. The licence expired in March, 2021, and was not renewed, Constable Wong said.
“Because the VPD no longer uses this product, the department has no knowledge of any alleged ties between the software and the Russian state,” he said.
Neither the Department of Defence nor the RCMP have responded to requests for comment.
U.S. authorities arrested the firm’s CEO, Lee Reiber of Boise, Idaho, in September and charged him with conspiracy to commit wire fraud.
A Russian national, Oleg Sergeyevich Davydov, was also arrested last month at London Heathrow Airport while in transit to Istanbul. The United States is expected to seek Mr. Davydov’s extradition, according to the Justice Department.
Opinion: This is the history that Vladimir Putin wants us to forget
Oxygen Forensics was incorporated in Virginia in 2013. An annual report from the following year lists Mr. Davydov as a vice-president and provides a Moscow address. Another Moscow-based individual was listed as the company’s CEO.
In the summer of 2022, the Moscow-based individuals were removed from the company’s corporate filings and Mr. Reiber was appointed CEO, the records show.
These changes were part of a conspiracy to conceal Oxygen Forensics’ true ownership in light of expanded U.S. sanctions against Russia in response to its invasion of Ukraine, according to an affidavit filed with the criminal complaint.
The affidavit from a U.S. special agent specializing in cyber investigations says the company is controlled by five Russian nationals, including Mr. Davydov, via a shell company in Cyprus. The five shareholders also allegedly own a Russian company whose customers included the Federal Security Service of the Russian Federation, also known as the FSB.
The affidavit says Oxygen Forensics sold the same software that it provided to Russian intelligence agencies under different branding.
Mr. Reiber was aware that American authorities had concerns with Russian-developed software, and earlier this year assured one of the company’s clients – the Department of Homeland Security – that no one in Russia had any role in developing the software, the affidavit alleges.
However, code for the company was written, reviewed and managed by a team in Russia, U.S. prosecutors claim.
At one point, the firm’s shareholders created an internal document that laid out various scenarios in which the Russian government could seek ownership or greater control of their companies, and discussed forging closer ties with state security services, the affidavit says.
U.S. prosecutors have not alleged that the shareholders acted on these discussions.
Since 2022, the company has secured around $2-million in contracts with U.S. agencies including the Secret Service and the Department of Defense, the affidavit says – adding that the firm sold its products to clients both directly and through resellers.
If convicted, Mr. Reiber and Mr. Davydov could face a maximum sentence of 20 years in federal prison.
Oxygen Forensics did not respond to The Globe’s requests for comment.