The Royal Canadian Mounted Police will not renew their contract with a software company accused of concealing its Russian ownership, and have ordered a probe of any security risks posed by the firm’s digital forensics tools, a spokesperson for the federal law enforcement agency says.
Earlier this year, the RCMP signed a licensing agreement with Oxygen Forensics, which is now at the centre of a criminal complaint in the United States alleging its owners falsely presented the firm as American to land government contracts.
In fact, the company was controlled by Russian nationals who were concerned about the effect on their business of increasingly strict economic sanctions against Russia, according to the criminal complaint filed by the U.S. Justice Department in late September.
Oxygen Forensics is tied to a Russian software developer that counts Russian security services amongst its clients, the criminal complaint alleges. The company’s software allows investigators to collect and extract data from digital devices.
In January, the RCMP spent around $34,000 on a licence for Oxygen Forensics’ software, publicly available procurement data show. In a statement to The Globe and Mail, a spokesperson for the agency, Ian Lordon, said there is “no plan” to renew the agreement, which expires in December.
RCMP contracted digital forensics company alleged to be secretly controlled by Russians
The RCMP have also asked the Canadian Centre for Cyber Security (CCCS) to launch a “supply chain integrity assessment” of Oxygen Forensics’ software, a process that looks at potential risks involved with technology products used by government agencies.
Oxygen Forensics’ digital forensics tools were deployed only in “limited circumstances when no other technical options were available,” Mr. Lordon told The Globe.
Any computers using the software have been isolated from the broader RCMP network, he added.
U.S. authorities have not alleged that Oxygen Forensics’ software contained malicious code or that it was used to gain unauthorized access to clients’ computer systems or data.
Communications Security Establishment Canada, which houses CCCS, did not respond to questions from The Globe about the supply chain assessment being conducted for Oxygen Forensics.
Several European law enforcement agencies, including London’s Metropolitan Police, have suspended their use of Oxygen Forensics’ software in the wake of the allegations.
Mr. Lordon said the RCMP’s licence with the firm was procured by Shared Services Canada, a federal department that manages information technology procurement and conducts due diligence on vendors to the government.
U.S. authorities arrested Oxygen Forensics’ chief executive officer, Lee Reiber of Boise, Idaho, in September and charged him with conspiracy to commit wire fraud.
A Russian national, Oleg Sergeyevich Davydov, was also arrested last month at London Heathrow Airport while in transit to Istanbul. The United States is expected to seek Mr. Davydov’s extradition, according to the Justice Department.
Oxygen Forensics was incorporated in Virginia in 2013, publicly available corporate records show. An annual report from the following year lists Mr. Davydov as a vice-president and provides a Moscow address. Another Moscow-based individual was listed as the company’s CEO.
In the summer of 2022, the Moscow-based individuals were removed from the company’s corporate filings and Mr. Reiber was appointed CEO, the records show.
These changes were part of a conspiracy to conceal Oxygen Forensics’ true ownership in light of expanded U.S. sanctions against Russia in response to its invasion of Ukraine, according to an affidavit filed with the criminal complaint.
Oxygen Forensics’ leadership falsely claimed that no one in Russia was involved with developing its software, when its code was actually written, reviewed and managed by a team in Russia, an affidavit from a U.S. special agent specializing in cyber investigations says.
The RCMP previously secured two contracts worth a total of around $90,000 with Oxygen Forensics, according to procurement data provided to The Globe by the law enforcement agency. Those contracts have been closed and completed, agency spokesperson Mr. Lordon said.
Mr. Lordon did not say when the law enforcement agency learned of the allegations made by the U.S. Justice Department against Oxygen Forensics.
“The RCMP is constantly sharing and receiving information related to commercial products with partner agencies,” he said.
Oxygen Forensics did not respond to The Globe’s requests for comment.