Russian‑Owned Forensics Firm Concealed Ownership While Supplying EU Police and U.S. Agencies, Raising Supply‑Chain Risks
What Happened — The U.S. Department of Justice indicted Oxygen Forensics, revealing that its CEO and Russian co‑founder hid the firm’s Russian ownership and the fact that its forensic software was developed in Russia. The company had sold the tools to U.S. federal agencies and, through EU‑funded projects (EVIDENCE and INSPECTr), provided the same software to European police forces and investigators for more than a decade.
Why It Matters for Trust & Control Assurance
- This scenario exemplifies a supply‑chain risk where undisclosed foreign control could compromise the integrity of digital evidence.
- Continuous third‑party risk monitoring and verifiable ownership documentation are core to a control‑assurance program that must demonstrate due diligence to auditors.
- Verisq’s Vendor Risk Management capability supplies ongoing evidence of vendor provenance, ownership changes, and compliance posture, enabling a defensible audit trail.
Who Is Affected – Law‑enforcement agencies and investigative bodies in the United States and European Union; vendors of forensic and digital‑evidence software.
Recommended Actions – Conduct an immediate third‑party risk review of all forensic tools, verify ownership and development location, and collect evidence of due‑diligence processes for audit readiness. Source: Security Affairs
Technical Notes – No technical vulnerability was disclosed; the risk stems from concealed foreign ownership and the potential for compromised forensic tooling within EU‑funded projects. Source: same