The US Department of Justice has arrested the CEO of Oxygen ForensicsLee Reiber, and Russian citizen Oleg Sergeyevich Davydov, accused of concealing that the company digital forensics based in Virginia was controlled by five Russians and that the software was developed in Russia, with links toFSB. The company’s products have been used by police forces and judiciaries in at least seven European Union countries, including Italy, and appear in a technical annex of the Sassari Prosecutor’s Office dated April 2026 which includes them among the tools available to the judicial police for the extraction and analysis of data from mobile devices.
Oxygen Forensics markets Forensic Detectivea phone hacking software used by police, courts and legal specialists to extract data from smartphones, computers and digital media. According to the DOJ accusation, a Russian operational structure was hidden behind the American facade: the development team worked in Russia under the direction of Davydov, while the ownership was attributable to five Russian citizens who also control Mko Systemssupplier of similar technologies to the FSB and the Ministry of the Interior in Moscow. US prosecutors do not allege that the software contained malicious code or was used to illegally access customers’ systems, but they disputed the concealment of Russian ownership and development ties.
Presence in EU projects and European prosecutors
Documents seen by Politico show that Oxygen Forensics participated in two European Union-funded projects on digital evidence management: EVIDENCE (European Informatics Data Exchange Framework for Courts and Evidence), active between March 2014 and October 2016 with a budget of 1.9 million euros, and INSPECTrfunded through Horizon 2020 and operational until 2023. Oxygen was among the companies consulted in the first project and its products were integrated into the software of the second to make data extracted with different tools interoperable. A spokeswoman for the European Commission specified that the company was not a member of the consortia and did not receive direct funds. However, it confirmed the diffusion of its tools in European investigative bodies.
In addition to Italy, purchases or accreditations of Oxygen products have been recorded in Germany, Spain, Poland, Hungary, Romania and Latviawith contracts active until at least September 2026. In Hungary, for example, the police signed a 27,000 euro contract in December 2024, valid until December 2025.
The Prosecutor’s Office of Sassari and the technical attachment
In Italy, the case involved the Public Prosecutor’s Office of Sassari. A technical annex to the operational protocol for the judicial police, adopted by the Sardinian office and dated April 2026, expressly mentions Oxygen Forensics among the systems that the judicial police can use for forensic extraction operations from mobile devices, alongside other tools such as Cellebrite UFED/Inseyets, GrayKey, MSAB XRY and Magnet Axiom. The document specifies that the inclusion in the operational list does not in itself certify the effective and concrete use in the judicial offices of the Turritan capital, but confirms the availability of the software among the technical options provided for by the protocol.
The technical annex of the Sassari Prosecutor’s Office is a document of over 70 pages that establishes uniform criteria for the collection, conservation, acquisition and documentation of digital evidence sources, with particular attention to smartphones, computers, storage media, SIMs, eSIMs and cloud systems. For mobile devices, the protocol indicates network isolation procedures (airplane mode, shielded containers or Faraday envelopes), the distinction between copy-medium (full forensic duplication) and the selection of only relevant data within a document, together with precautions to manage encryption, remote reset and automatic locking mechanisms.
The Oxygen case fits into a broader framework of tensions between national security and technological dependencies. Italy, together with other European countries, has repeatedly accused Moscow of conducting a hybrid warfarebut at the same time recognized the use of tools developed in Russia in the area of internal security. At the same time, another Italian company in the surveillance sector, Memento Labs (born from the acquisition of Hacking Team), was at the center of controversy after Kaspersky identified its spyware Dante in targeting campaigns against media, universities and government organizations in Russia and Belarus.
