Oxygen Forensics, secretly Russian-operated, infiltrated European law enforcement by providing digital forensic tools used in EU projects and national police agencies, raising concerns of data compromise.

Intelligence & EspionageCounterintelligence SabotageTargeting enemy agencies with infiltration

Aggressor

Summary

A U.S.-based data-extraction firm, Oxygen Forensics, officially headquartered in Virginia but secretly operated from Russia, infiltrated European law enforcement by providing powerful digital forensic software used across multiple EU-backed projects and by national police agencies. Oxygen Forensics was involved in two major EU-funded projects (EVIDENCE and INSPECTr) aimed at enhancing digital evidence handling among European law enforcement institutions. Despite Russian ownership concealed after 2022 sanctions, the firm's technology remained widely used by police in Germany, Spain, Italy, Poland, Hungary, Romania, and Latvia. The U.S. Justice Department charged the company and arrested key personnel, revealing links to Russian security services (FSB and Interior Ministry) via a sister company. The software was also supplied under EU-funded programs to Moroccan authorities. Concerns arise over sensitive EU criminal evidence being potentially accessed by Russian authorities.

Classification

Confidence: High

The case involves covert Russian ownership and control over a technology firm infiltrating European law enforcement digital evidence infrastructure, providing critical software used in criminal investigations, with links to Russian security services (FSB), representing a clear hostile intelligence and espionage operation within EU security structures.

Source URL

https://www.politico.eu/article/russia-tech-surveillance-company-infiltrated-europes-law-enforcement-agencies/

Open source

Provenance

Publisher: extension
Submitted: Sep 28, 2026, 13:41 UTC
Last updated: Nov 4, 2026, 08:36 UTC
Event time: Oct 10, 2023, 00:00 UTC

Published as a hybrid-warfare signal with a public source and reviewer-approved assessment bands. See the methodology for how records are assessed.

Raw record

{
  "id": "079543f4-0ec6-4b36-a769-7d51574df79b",
  "url": "https://www.politico.eu/article/russia-tech-surveillance-company-infiltrated-europes-law-enforcement-agencies/",
  "source": "extension",
  "status": "approved",
  "category": "Intelligence & Espionage",
  "subcategory": "Counterintelligence Sabotage",
  "incident_type": "Targeting enemy agencies with infiltration",
  "country": "European Union",
  "source_reliability": "B",
  "info_credibility": "2",
  "tags": [
    "Russia",
    "European Union",
    "offensive cyber operations",
    "Law Enforcement",
    "Digital Forensics",
    "Hybrid Warfare",
    "Surveillance",
    "Sanctions",
    "Intelligence",
    "FSB"
  ],
  "nodes": [],
  "countries": [
    "European Union"
  ],
  "where_text": "Cyberspace",
  "headline": null,
  "description": "A U.S.-based data-extraction firm, Oxygen Forensics, officially headquartered in Virginia but secretly operated from Russia, infiltrated European law enforcement by providing powerful digital forensic software used across multiple EU-backed projects and by national police agencies. Oxygen Forensics was involved in two major EU-funded projects (EVIDENCE and INSPECTr) aimed at enhancing digital evidence handling among European law enforcement institutions. Despite Russian ownership concealed after 2022 sanctions, the firm's technology remained widely used by police in Germany, Spain, Italy, Poland, Hungary, Romania, and Latvia. The U.S. Justice Department charged the company and arrested key personnel, revealing links to Russian security services (FSB and Interior Ministry) via a sister company. The software was also supplied under EU-funded programs to Moroccan authorities. Concerns arise over sensitive EU criminal evidence being potentially accessed by Russian authorities.",
  "summary_short": "Oxygen Forensics, secretly Russian-operated, infiltrated European law enforcement by providing digital forensic tools used in EU projects and national police agencies, raising concerns of data compromise.",
  "summary_extended": null,
  "actor_primary": "Oxygen Forensics",
  "target_primary": null,
  "location_text": "European Union",
  "location_region": null,
  "location_coordinates_lat": 52,
  "location_coordinates_lon": 10,
  "location_precision": "Regional",
  "is_aggressor_signal": true,
  "signal_type": "HYBRID_SIGNAL",
  "is_hybrid_war_signal": true,
  "classification_complete": true,
  "hybrid_signal_complete": true,
  "classification_confidence": "High",
  "classification_rationale": "The case involves covert Russian ownership and control over a technology firm infiltrating European law enforcement digital evidence infrastructure, providing critical software used in criminal investigations, with links to Russian security services (FSB), representing a clear hostile intelligence and espionage operation within EU security structures.",
  "event_time_utc": "2023-10-10T00:00:00.000Z",
  "end_time_utc": null,
  "event_time_confidence": "pm24h",
  "created_at": "2026-09-28T13:41:00.049Z",
  "updated_at": "2026-11-04T08:36:03.522Z",
  "reliability_band": "strong",
  "location_precision_band": "regional",
  "time_precision_band": "within_24h",
  "severity_band": "significant",
  "attribution_confidence_band": "high",
  "attribution_basis": "independent_sources"
}

Public assessmentReliability: StrongSeverity: SignificantAttribution: HighIndependence confirmedTime: Same dayLocation: Regional

Source reliability

Info credibility

Event time

Oct 10, 2023, 00:00 UTC

Event time confidence

pm24h

Location

European Union

Primary actor

Oxygen Forensics

Country

European Union

Countries

European Union

Tags

Russia, European Union, offensive cyber operations, Law Enforcement, Digital Forensics, Hybrid Warfare, Surveillance, Sanctions, Intelligence, FSB

Loading signal...

{ "id": "079543f4-0ec6-4b36-a769-7d51574df79b", "url": "https://www.politico.eu/article/russia-tech-surveillance-company-infiltrated-europes-law-enforcement-agencies/", "source": "extension", "status": "approved", "category": "Intelligence & Espionage", "subcategory": "Counterintelligence Sabotage", "incident_type": "Targeting enemy agencies with infiltration", "country": "European Union", "source_reliability": "B", "info_credibility": "2", "tags": [ "Russia", "European Union", "offensive cyber operations", "Law Enforcement", "Digital Forensics", "Hybrid Warfare", "Surveillance", "Sanctions", "Intelligence", "FSB" ], "nodes": [], "countries": [ "European Union" ], "where_text": "Cyberspace", "headline": null, "description": "A U.S.-based data-extraction firm, Oxygen Forensics, officially headquartered in Virginia but secretly operated from Russia, infiltrated European law enforcement by providing powerful digital forensic software used across multiple EU-backed projects and by national police agencies. Oxygen Forensics was involved in two major EU-funded projects (EVIDENCE and INSPECTr) aimed at enhancing digital evidence handling among European law enforcement institutions. Despite Russian ownership concealed after 2022 sanctions, the firm's technology remained widely used by police in Germany, Spain, Italy, Poland, Hungary, Romania, and Latvia. The U.S. Justice Department charged the company and arrested key personnel, revealing links to Russian security services (FSB and Interior Ministry) via a sister company. The software was also supplied under EU-funded programs to Moroccan authorities. Concerns arise over sensitive EU criminal evidence being potentially accessed by Russian authorities.", "summary_short": "Oxygen Forensics, secretly Russian-operated, infiltrated European law enforcement by providing digital forensic tools used in EU projects and national police agencies, raising concerns of data compromise.", "summary_extended": null, "actor_primary": "Oxygen Forensics", "target_primary": null, "location_text": "European Union", "location_region": null, "location_coordinates_lat": 52, "location_coordinates_lon": 10, "location_precision": "Regional", "is_aggressor_signal": true, "signal_type": "HYBRID_SIGNAL", "is_hybrid_war_signal": true, "classification_complete": true, "hybrid_signal_complete": true, "classification_confidence": "High", "classification_rationale": "The case involves covert Russian ownership and control over a technology firm infiltrating European law enforcement digital evidence infrastructure, providing critical software used in criminal investigations, with links to Russian security services (FSB), representing a clear hostile intelligence and espionage operation within EU security structures.", "event_time_utc": "2023-10-10T00:00:00.000Z", "end_time_utc": null, "event_time_confidence": "pm24h", "created_at": "2026-09-28T13:41:00.049Z", "updated_at": "2026-11-04T08:36:03.522Z", "reliability_band": "strong", "location_precision_band": "regional", "time_precision_band": "within_24h", "severity_band": "significant", "attribution_confidence_band": "high", "attribution_basis": "independent_sources" }