Czech Police Use Sensitive Forensic Software. Supplier Allegedly Hid Its Russian Links

The case is much broader, however. In the United States, it resulted in the arrest of the CEO of Oxygen Forensics and one of the alleged Russian owners, the seizure of dozens of internet domains, and the revelation of an ownership structure purportedly hidden from the U.S. government for several years.

Stanislav Novotný

September 30, 2026

Czech Police Use Sensitive Forensic Software. Supplier Allegedly Hid Its Russian Links

The Czech police have taken preliminary measures in response. According to findings by Deník N, officers received instructions not to update the software. The Police Presidium also recommended that units work with the system in a "special mode" until the situation is clarified.

Forensic Tool Handles the Most Sensitive Data

Oxygen Forensic Detective is not standard office software. It is a tool for digital forensic analysis that allows for the extraction, recovery, preservation, and analysis of data from mobile phones, computers, and other electronic devices.

Such tools are used by investigators, for example, when analyzing seized electronics and digital evidence.

iROZHLAS.cz found 25 publicly available contracts in the Czech contract registry involving Oxygen Forensics software or training related to its products. The value of Oxygen's services in these contracts exceeds 14.5 million CZK.

Customers include the Ministry of the Interior, specifically the Police Presidium, the General Directorate of Customs, the Ministry of Defense, and six regional police directorates – Prague, Central Bohemian, South Moravian, Moravian-Silesian, Plzeň, and Vysočina.

The Customs Administration confirmed that outputs from this software are used in investigating serious, organized, and transboundary crime.

Americans Claim Five Russians Were Behind the American Company

The problem becomes apparent when looking at the investigation in the United States.

On September 23, the U.S. Department of Justice announced the arrest of 55-year-old Oxygen Forensics CEO Lee Reiber and 52-year-old Russian citizen Oleg Sergeevich Davydov.

Both are charged with conspiracy to commit wire fraud. These are allegations for now, and neither man's guilt has been proven.

According to U.S. investigators, Oxygen Forensics presented itself to government clients as an independent American company based in Virginia. In reality, it was supposedly owned and controlled by five Russian citizens via a holding company in Cyprus.

One of them was allegedly Davydov.

Russian involvement does not end with ownership.

According to an affidavit attached to the criminal complaint, the developers creating the software worked in Russia. The software was written and managed by a team in Russia under Davydov's direction, and the cloud environment in which it was developed was managed by another of the Russian owners.

After the Invasion of Ukraine, Russian Owners Were to Disappear from Public Records

The timeline described by U.S. investigators is significant.

Following the Russian invasion of Ukraine and the expansion of U.S. sanctions in 2022, Reiber, Davydov, and others supposedly agreed to conceal the true Russian ownership of Oxygen Forensics and the software development in Russia.

In March 2022, Reiber became CEO, president, and board chairman. Subsequently, the Russian owners disappeared from public corporate records.

According to the U.S. Department of Justice, however, their actual influence did not end.

The Russian owners continued to make significant decisions, determine Reiber's compensation, interfere in company payments, and hold signing rights for corporate bank accounts.

One of the Russian owners was later even appointed to the company's board under a Turkish identity.

The American Government Was Allegedly Provided Different Information Repeatedly

Meanwhile, Oxygen Forensics sought contracts with U.S. security institutions.

According to investigators, in December 2022 and October 2023, Reiber falsely certified to the U.S. government that Oxygen Forensics had no immediate or top owner.

In July 2024, it was supposed to confirm to American authorities that no foreign person had the ability to control the appointment of company management or direct its decisions.

Investigators claim the reality was different.

In September 2024, Oxygen nonetheless obtained a five-year contract for the National Computer Forensics Institute, which falls under the U.S. Secret Service.

A remarkable event occurred in March 2026. Reiber allegedly told officials at the U.S. Department of Homeland Security that no Russian participated in software development and no one in Russia had access to the environment in which the software was created.

Just days later, he published a similar statement on the company's website.

The American investigation, however, contends that the software was indeed written and managed by a team in Russia under Davydov's leadership.

The Same Owners Were Also Behind a Russian Company Supplying Software to Security Forces

Another connection described by the U.S. Department of Justice is crucial to the entire case.

The same five Russian citizens allegedly owned a Russian company, which until September 2022 was called Oxygen Software LLC and now operates as MKO Systems LLC.

Davydov co-founded it back in 2000 and served as its chief technology officer.

According to U.S. investigators, this company sold software in Russia under different product names. Its customers reportedly included the Russian Federal Security Service FSB, the Investigative Committee of the Russian Federation, and the Russian Ministry of Internal Affairs.

This alone doesn't mean these institutions had access to the data of foreign users of Oxygen Forensics. But it shows why the true ownership of the company and the location of its software development are significant information for security institutions.

Americans Seized Accounts and Dozens of Domains

The U.S. authorities acted against the company even before publishing the charges.

On September 19, a federal judge allowed the seizure of the company's bank accounts, approximately 57 internet domains, and other infrastructure said to be used in the described activities.

The actual seizure of domains and related infrastructure took place on September 20.

Reiber was arrested in Idaho. The British authorities detained Davydov at London Heathrow Airport before his flight to Istanbul, and the United States intends to request his extradition.

If convicted, both defendants face a maximum of 20 years in federal prison, according to the U.S. Department of Justice.

Czech Police Halted Software Updates

The impact of the American case has now reached the Czech Republic as well.

The Police Presidium confirmed to iROZHLAS that it took "necessary preliminary measures" in response to the information from the United States. The police did not want to publicly describe their exact nature, given how the products are used.

Deník N later found out that the Police Presidium ordered that the system not be updated.

According to Novinky, the Police Presidium also recommended individual units work with the system in a "special mode" until all information from foreign partners is available.

The Ministry of the Interior is also assessing the situation. The Customs Administration stated that Oxygen is just one of several forensic tools they use.

The Problem Isn't Just in the Czech Republic

Oxygen Forensics has not only reached Czech security forces.

According to documents described by the media, the company's products were used or purchased by police forces in several European countries, such as Germany, Spain, Italy, or Poland.

Oxygen products also appeared in two projects focused on digital evidence financed by the European Union. However, the European Commission clarified that Oxygen was not a member of the consortia for these projects and did not receive European funding itself.

The British Metropolitan Police has suspended the use of Oxygen Forensics and initiated a review. According to The Times, the tool was deployed only in a limited capacity and was used on isolated systems.

Thus, the situation has now surpassed a mere American criminal case. Security institutions that acquired the software must now assess for themselves whether the information about its true ownership and development changes their view of the risks associated with its use.

Important Boundary: No Evidence of a Backdoor Exists Yet

The entire case has one crucial boundary.

The U.S. Department of Justice explicitly states that the criminal complaint does not allege that the software contained malicious code or was used to gain unauthorized access to customer computer systems or data.

There is thus no public evidence that data from the Czech police, customs, or the Ministry of Defense leaked to Russia through Oxygen Forensics.

According to iROZHLAS, the Czech distributor also recommends operating the software in an air-gapped environment—on an isolated device without connection to the regular network or internet. This setup significantly limits the system's ability to communicate with the outside world.

The current affair is primarily a problem of trust in the supply chain.

For ordinary software, the real owner and location of development are important information. For a tool designed to extract and analyze digital evidence from the phones and computers of security forces, the importance of this information is even greater.

If the claims of U.S. investigators are proven, American institutions purchased sensitive forensic technology believing it came from an independent American company, while its true owners and a significant part of its development were in Russia.

And the same software has meanwhile found its way to Czech security institutions.

Sources

Loading comments...