A digital forensics vendor's dual-track record reaches European police forces

A firm supplying digital forensic software to both United States government agencies and Russia’s Federal Security Service (FSB) has also worked with law enforcement bodies across the European Union.

Oxygen Forensics, a company known for tools that extract and analyse data from mobile phones, cloud accounts, and personal devices, provided its software to police and security authorities in EU member states alongside its commercial ties to American agencies and Moscow’s primary domestic security service.

The findings highlight the intricate and international supply chains behind the specialized digital toolkits that modern police forces rely on when extracting evidence from seized hardware during criminal investigations.

For ordinary citizens, digital forensic software is the technical key police use to inspect locked smartphones and encrypted drives during investigations. When law enforcement agencies buy commercial software to break into devices, they rely entirely on private vendors to unlock sensitive data without creating wider security vulnerabilities.

When police forces use software developed by vendors that simultaneously service geopolitical rivals and intelligence agencies, concerns move quickly from routine procurement to fundamental cyber security. The overlap raises pressing questions about data sovereignty, potential software backdoors, and whether investigative tools used in Europe could be exposed to foreign oversight.

Inside the Brussels bubble, cross-border police cooperation relies heavily on shared data networks and technical standards coordinated through Europol, the European Union's agency for law enforcement cooperation, alongside national police federations.

While EU institutions frequently promote technical sovereignty and stringent cyber defence rules, actual procurement of police equipment remains largely decentralized across member states. Working with vendors who simultaneously supply Russian security services presents a classic institutional head-scratcher: European policy demands cutting-edge investigative capabilities, yet procurement frameworks can struggle to vet the complex lineages of specialized software. It serves as a quiet reminder that while European cyber directives are drafted in pristine conference rooms, the software running on a detective's laptop sometimes arrives with a rather tangled passport.

European law enforcement agencies and national ministries face immediate scrutiny over how software suppliers are vetted for police use.

Members of the European Parliament are expected to push for stricter auditing guidelines and centralized security standards for forensic software contracts, seeking to ensure that member state police forces do not purchase sensitive technical tools from suppliers operating within rival intelligence ecosystems.