The Royal Canadian Mounted Police will not renew their contract with a software company accused of concealing its Russian ownership, and have ordered a probe of any security risks posed by the firm’s digital forensics tools, a spokesperson for the federal law enforcement agency says.
asserted
spokesperson → renew → agency
Earlier this year, the RCMP signed a licensing agreement with Oxygen Forensics, which is now at the centre of a criminal complaint in the United States alleging its owners falsely presented the firm as American to land government contracts.
asserted
owners → sign → contracts
In fact, the company was controlled by Russian nationals who were concerned about the effect on their business of increasingly strict economic sanctions against Russia, according to the criminal complaint filed by the U.S. Justice Department in late September.
uncertain
who → control → September
Oxygen Forensics is tied to a Russian software developer that counts Russian security services amongst its clients, the criminal complaint alleges.
asserted
complaint → tie → clients
The company’s software allows investigators to collect and extract data from digital devices.
asserted
investigators → allow → devices
In January, the RCMP spent around $34,000 on a licence for Oxygen Forensics’ software, publicly available procurement data show.
asserted
data → spend → software
In a statement to The Globe and Mail, a spokesperson for the agency, Ian Lordon, said there is “no plan” to renew the agreement, which expires in December.
asserted
which → say → December
The RCMP have also asked the Canadian Centre for Cyber Security (CCCS) to launch a “supply chain integrity assessment” of Oxygen Forensics’ software, a process that looks at potential risks involved with technology products used by government agencies.
asserted
that → ask → agencies
Oxygen Forensics’ digital forensics tools were deployed only in “limited circumstances when no other technical options were available,” Mr. Lordon told The Globe.
asserted
Lordon → deploy → Globe
Any computers using the software have been isolated from the broader RCMP network, he added.
asserted
he → use → network
U.S. authorities have not alleged that Oxygen Forensics’ software contained malicious code or that it was used to gain unauthorized access to clients’ computer systems or data.
asserted
it → allege → systems
Communications Security Establishment Canada, which houses CCCS, did not respond to questions from The Globe about the supply chain assessment being conducted for Oxygen Forensics.
asserted
which → house → Forensics
Several European law enforcement agencies, including London’s Metropolitan Police, have suspended their use of Oxygen Forensics’ software in the wake of the allegations.
asserted
agencies → include → allegations
Mr. Lordon said the RCMP’s licence with the firm was procured by Shared Services Canada, a federal department that manages information technology procurement and conducts due diligence on vendors to the government.
asserted
that → say → government
U.S. authorities arrested Oxygen Forensics’ chief executive officer, Lee Reiber of Boise, Idaho, in September and charged him with conspiracy to commit wire fraud.
asserted
authorities → arrest → fraud
A Russian national, Oleg Sergeyevich Davydov, was also arrested last month at London Heathrow Airport while in transit to Istanbul.
asserted
national → arrest → Istanbul
The United States is expected to seek Mr. Davydov’s extradition, according to the Justice Department.
uncertain
States → expect → Department
Oxygen Forensics was incorporated in Virginia in 2013, publicly available corporate records show.
asserted
records → incorporate → 2013
An annual report from the following year lists Mr. Davydov as a vice-president and provides a Moscow address.
asserted
report → list → address
Another Moscow-based individual was listed as the company’s CEO.
asserted
individual → base → CEO
In the summer of 2022, the Moscow-based individuals were removed from the company’s corporate filings and Mr. Reiber was appointed CEO, the records show.
asserted
records → base → filings
These changes were part of a conspiracy to conceal Oxygen Forensics’ true ownership in light of expanded U.S. sanctions against Russia in response to its invasion of Ukraine, according to an affidavit filed with the criminal complaint.
uncertain
changes → conceal → complaint
Oxygen Forensics’ leadership falsely claimed that no one in Russia was involved with developing its software, when its code was actually written, reviewed and managed by a team in Russia, an affidavit from a U.S. special agent specializing in cyber investigations says.
asserted
affidavit → claim → investigations
The RCMP previously secured two contracts worth a total of around $90,000 with Oxygen Forensics, according to procurement data provided to The Globe by the law enforcement agency.
uncertain
RCMP → secure → agency
Those contracts have been closed and completed, agency spokesperson Mr. Lordon said.
asserted
Lordon → close → ?
Mr. Lordon did not say when the law enforcement agency learned of the allegations made by the U.S. Justice Department against Oxygen Forensics.
asserted
agency → say → Forensics
“The RCMP is constantly sharing and receiving information related to commercial products with partner agencies,” he said.
asserted
he → share → agencies
Oxygen Forensics did not respond to The Globe’s requests for comment.
asserted
Forensics → respond → comment
The Aporia
