Met Pauses Digital Forensics Software: What Hidden Ownership Allegations Show About Technology Supplier Due Diligence

The Metropolitan Police has reportedly suspended its use of digital-forensics software supplied by Oxygen Forensics following allegations in the United States concerning the company's ownership, control and where its software was developed.

The development follows the arrest of Oxygen Forensics chief executive Lee Reiber and Russian national Oleg Davydov in connection with a U.S. federal criminal complaint.

According to the U.S. Department of Justice, prosecutors allege that Oxygen Forensics presented itself to U.S. government agencies as an independent American company while five Russian nationals actually owned and controlled the business through a Cyprus-based holding company.

The Justice Department also alleges that the software was developed in Russia, despite representations that the company did not have foreign ownership or Russian involvement in its development.

These are allegations and have not been proven in court. The Justice Department has also specifically stated that the complaint does not allege that the software contained malicious code or that it was used to obtain unauthorised access to customers' systems or data.

The case nevertheless raises an important due-diligence question for organisations procuring sensitive technology:

How well do you understand who ultimately owns and controls the supplier behind the product?

What Is Alleged in the Oxygen Forensics Case?

Oxygen Forensics is a digital-forensics software company based in Virginia in the United States.

Its software is used to recover, preserve and analyse data from electronic devices and has been supplied to government and law-enforcement organisations.

According to the U.S. criminal complaint, Oxygen Forensics held itself out to government customers as an independent U.S.-based company.

Prosecutors allege that the company was actually owned and controlled by five Russian nationals through a holding company in Cyprus.

The same individuals are alleged to have owned a Russian company involved in development of the software.

Following the expansion of U.S. sanctions against Russia in 2022, prosecutors claim the Russian owners were removed from Oxygen Forensics' public corporate filings while continuing to exercise significant influence over the business.

The complaint alleges that this included involvement in major decisions, control over certain payments and signatory authority over company bank accounts.

Prosecutors further allege that certifications were subsequently provided to U.S. government agencies stating that the company had no relevant foreign ownership or control.

All defendants are presumed innocent unless and until proven guilty.

Why Public Corporate Records May Not Tell the Whole Story

Corporate registers are an important starting point when assessing a prospective supplier.

They can help establish matters including:

• Registered ownership.
• Directors and officers.
• Changes in control.
• Registered addresses.
• Filing history.
• Connected corporate entities.

But the information appearing on a register may not always provide a complete picture of who exercises practical control over a business.

This is particularly relevant where ownership structures extend across several jurisdictions, involve holding companies or have recently changed.

A shareholder may disappear from a public filing while retaining an economic interest or influence elsewhere within the structure.

An individual may no longer hold a formal directorship but remain involved through another company, contractual relationship or position within a wider corporate group.

The issue is therefore not simply identifying the names appearing on a company record.

Effective Due Diligence Services may require consideration of the wider ownership structure, connected entities, historic relationships and whether the public presentation of a business is consistent with independently available information.

Technology Suppliers Can Present Different Due-Diligence Questions

The significance of ownership and control increases when the supplier performs a sensitive function.

A business providing office furniture does not necessarily present the same risk profile as a company providing software used to analyse confidential information, access sensitive systems or support law-enforcement activity.

For technology suppliers, organisations may need to understand questions such as:

• Who ultimately owns and controls the company?
• Where is the software developed?
• Where are key development teams located?
• Which companies or individuals are connected to the supplier?
• Have there been significant recent ownership changes?
• Are any relevant parties exposed to sanctions or regulatory restrictions?
• Does the information provided during procurement match independent corporate records?
• Are important parts of the service delivered through another jurisdiction or associated company?

The appropriate depth of review should depend on the sensitivity of the product and the potential consequences if important information has been misunderstood.

Ownership and Development Location Are Different Questions

The Oxygen Forensics allegations also illustrate why organisations should distinguish between several related issues.

A supplier may be incorporated in one country while ultimately owned from another.

Its software may be marketed, sold and supported in one jurisdiction while being developed somewhere else.

Infrastructure may also be administered by individuals or companies based in another country entirely.

None of these arrangements is automatically improper.

International technology businesses routinely use distributed development teams and cross-border corporate structures.

The due-diligence objective is not to treat international ownership as suspicious.

It is to understand the actual structure so that procurement decisions are made using accurate information.

Where the supplier's ownership, control or development arrangements are material to regulatory, contractual or security requirements, those facts may need to be independently verified.

Sensitive Procurement May Justify Enhanced Scrutiny

The level of due diligence appropriate for a supplier should be proportionate to the role it will perform.

Greater scrutiny may be justified where a third party:

• Handles particularly sensitive information.
• Provides cyber-security or digital-forensics technology.
• Has access to critical systems.
• Supports defence, government or law-enforcement activity.
• Operates across jurisdictions subject to sanctions or export controls.
• Has a complex or opaque ownership structure.
• Makes important representations about where its technology is developed.
• Provides a service where undisclosed third-party involvement could materially change the risk profile.

This does not mean that every technology supplier requires an extensive investigation.

A proportionate approach remains important.

However, where a supplier is trusted with sensitive systems, data or operational capability, relying exclusively on information supplied during the procurement process may leave important questions unanswered.

Conflict International's guide to Business Partner Due Diligence explains why ownership, corporate history, connected companies and independent verification can become particularly relevant before entering significant commercial relationships.

Changes in Ownership Can Matter as Much as Initial Ownership

Due diligence is often concentrated at the beginning of a supplier relationship.

That makes sense, but significant relationships can continue for many years.

During that period:

• Ownership can change.
• Directors can change.
• Holding structures can be reorganised.
• Development work can move between jurisdictions.
• New investors can enter the business.
• Regulatory or sanctions exposure can change.
• Previously unknown corporate relationships can emerge.

For sensitive or strategically important suppliers, these changes may justify reviewing information that was originally established during procurement.

The purpose is not continuous investigation of every supplier.

Rather, organisations should identify which relationships are sufficiently important that a material change in ownership or control would matter to the business.

Due Diligence Is Not the Same as Cyber-Security Testing

The allegations in the Oxygen Forensics case also highlight an important distinction.

Corporate due diligence and technical security assessment answer different questions.

Cyber-security testing may assess how secure a product is, whether vulnerabilities exist and how information is protected.

Corporate due diligence instead examines the organisation and people behind the supplier.

One process cannot necessarily substitute for the other.

A technically capable product can still be supplied through an organisation whose ownership or representations deserve further scrutiny.

Equally, concerns about a company's ownership do not automatically establish that its technology is insecure.

That distinction is particularly important here because U.S. prosecutors have expressly stated that their complaint does not allege that Oxygen Forensics software contained malicious code or was used to gain unauthorised access to customer systems.

The allegations concern the company's ownership, control, software-development arrangements and representations made to government customers.

Understanding the Supplier Behind the Technology

Modern organisations increasingly depend on specialist technology providers.

Those relationships can involve access to confidential data, sensitive systems and business-critical processes.

In that environment, supplier due diligence should not stop at confirming that a company exists or reviewing the features of its product.

For higher-risk relationships, decision-makers may need to understand:

• Who ultimately owns the supplier.
• Who exercises meaningful control.
• Which companies and individuals sit behind the structure.
• Where important products or services are actually developed.
• Whether representations made during procurement can be independently verified.

The developing Oxygen Forensics case does not establish that foreign ownership itself represents a problem, nor does it establish that the company's software was malicious.

What it does demonstrate is why ownership and control can be commercially and operationally significant when procuring sensitive technology.

Due diligence cannot eliminate every supplier risk.

It can, however, reduce the likelihood that an important procurement decision is made on the basis of an incomplete understanding of who sits behind the company being appointed.