The Oxygen Forensics case and the limits of third-party visibility

A recent POLITICO investigation alleged that Oxygen Forensics, a digital forensics company used by European law enforcement agencies and EU-funded projects, concealed Russian ownership and development activities while presenting itself as a US-based supplier. While there have been no reports of customer systems being compromised, the reporting raises a different set of questions. Specifically, it highlights the challenges organisations face in understanding who ultimately owns, controls and influences a trusted supplier.

A trusted third party

Digital forensic vendors occupy a distinctive position within the organisations they serve. Their products are used to collect, process and analyse highly sensitive information, often as part of criminal investigations. They support evidence-handling processes and become embedded within critical operational workflows.

In the Oxygen case, the third party is the forensic vendor itself. Behind that sits a fourth party consisting of the beneficial owners and developers who ultimately influence or control the service being delivered. Beyond that sits a fifth layer comprising affiliated organisations, related firms and, potentially, state customers.

Most insider risk programmes focus on employees, contractors and, increasingly, direct suppliers. However, due diligence and visibility often diminish beyond this first layer of trust, even though influence and exposure may extend further.

Visibility beyond the supplier

Limited transparency over who owns a supplier, who develops its software and who exercises operational control can make it difficult for organisations to assess where risk lies. In the case of digital forensic tools, this matters because the product sits within sensitive investigation workflows and may communicate externally through software updates, licensing systems and telemetry. These connections can create potential routes of exposure for data or metadata. There is no evidence that this occurred in the Oxygen case; the concern is that incomplete visibility a supplier's extended network makes such exposure harder to evaluate.

The implications extend beyond the possible transfer of data. Knowledge of which law-enforcement agencies use a forensic tool, where it is deployed and how extensively it is relied upon may itself have intelligence value. Licensing, support and deployment records could reveal which agencies cooperate, which technologies they share and where particular forensic capabilities exist.

Knowing which agencies use a particular tool could help an adversary conceal its activity, adapt its methods and identify where it is most likely to be detected. It could also support counter-forensic testing: techniques, devices or malware could be evaluated against the capabilities associated with that tool, potentially exposing weaknesses in evidence collection or analysis. Over time, this could weaken agencies’ investigative advantage by helping adversaries anticipate how devices will be examined and which traces investigators will look for.

The consequences could extend beyond individual investigations, allowing an adversary to disrupt several agencies or place wider pressure on them. A state-linked actor could use this information to prioritise espionage targets, identify where access to technical support or updates is operationally critical, and assess which agencies would be most affected if a service were withdrawn. Even without access to case data, this could show an adversary which agencies have the strongest forensic capabilities and which may be least able to withstand disruption.

An insider risk perspective

The Oxygen case points to a broader challenge for insider risk: trust is not limited to employees. Modern organisations rely on extensive networks of suppliers, contractors and service providers, many of whom receive legitimate access to sensitive systems, data and operational processes. Yet because they sit outside the formal organisation, these third parties can become the ‘forgotten insiders’, trusted enough to gain access, but not always subject to equivalent visibility and oversight.

A recent US case illustrates the point. Prosecutors allege that a government contractor with top-secret clearance accessed classified intelligence outside the scope of his duties and passed it to a romantic partner who published a Substack newsletter. The allegations remain unproven, but the case shows how authorised access can create insider risk regardless of whether the person exercising it is an employee or a contractor.

In complex organisations, assessing every external relationship to the same standard is neither realistic nor effective. Organisations must therefore identify the vendors whose access, technology or services are most critical to sensitive operations and subject them to proportionate, rigorous due diligence and continuous monitoring. Gaps in ownership checks and oversight matter most in these high-trust relationships. This attention must continue after onboarding, as ownership, personnel, development arrangements and sanctions exposure can change over time.

Without appropriate visibility, organisations may know that a third party has access but lack meaningful oversight of how that access is used, what happens to their data and which other parties may influence its handling. Fragmented procurement compounds the problem, as concerns identified by one agency, jurisdiction or programme may not be visible elsewhere.

The central challenge is therefore not to scrutinise every supplier equally, but to identify where trust, access and operational dependency intersect.

Looking beyond the third party

The Oxygen Forensics allegations will ultimately be assessed through legal and regulatory processes. However, the broader questions raised by the case extend beyond a single company. The case highlights the importance of understanding not only the supplier itself, but also the ownership structures, development arrangements and relationships that sit behind it.

Signpost Six advises therefore to identify the suppliers that matter most: those whose access, technology or services are critical to sensitive operations. For these suppliers, organisations should look beyond the contracted entity to understand who owns and influences it, which other parties support it, and how those relationships change over time. Relevant concerns should also be shared across procurement teams, agencies and programmes rather than remaining siloed.

Trust in a supplier is rarely confined to the legal entity named in the contract. In complex supply chains, visibility often diminishes beyond the third party. Risk, however, may not.