The news
Three stories published on October 1 and 2 put the tools used to break into phones under a harsher light: a London police pause over alleged Russian links, a new way around an iPhone protection, and a US court ruling that left spyware targets without a forum.
London's Metropolitan Police paused its use of software from Oxygen Forensics, a company based in Alexandria, Virginia, The Register reported on October 2. US Department of Justice prosecutors have accused Oxygen chief executive Lee Reiber and Russian national Oleg Sergeyevich Davydov of concealing who owned the company and where its software was built. According to the allegations, five Russian nationals controlled Oxygen through a Cyprus holding company and also owned Moscow-based MKO Systems, where the software was actually developed and which sold the technology to Russian customers including the FSB security service. Davydov, 52, was arrested at Heathrow Airport.
A Met spokesperson said the force had paused the tool while it carried out a full review and expected any impact on ongoing investigations to be extremely limited. The Met said Oxygen software was used in less than 0.2% of more than 23,000 digital forensics actions over the past year; it signed a three-year deal with the company in December 2023. The National Police Chiefs' Council stressed that the claims remain allegations, said prosecutors are not alleging the software contained malicious code or that customer data was accessed, and said other UK forces also use Oxygen products and have been encouraged to assess them. The Register's report did not include a response from Oxygen or Reiber.
Separately, 404 Media reported on October 1 that Magnet Forensics has built GrayKey Preserve, a new device, and Evidence Preservation Mode, a feature for existing GrayKey units, to get around the iPhone's inactivity reboot. Apple introduced that feature in November 2024; it restarts an iPhone that has not been unlocked for 72 hours, returning it to a more protected state. 404 Media based its report on a Magnet Forensics promotional video it obtained.
On October 2, The Record reported, a federal judge in California dismissed a lawsuit brought by Carlos Dada and colleagues at El Faro, an independent Salvadoran news outlet, against NSO Group, maker of the Pegasus spyware. The judge found the case had no proper connection to California. The suit, filed in November 2022 and described as the first against NSO in a US court by journalists, alleged Pegasus was used against the lead plaintiff at least 226 times between June 2020 and November 2021. A previous judge dismissed it in March 2024 on similar grounds. The Knight First Amendment Institute, which represents the journalists, plans to appeal. NSO Group did not immediately respond to The Record's request for comment.
The numbers
- Met forensics actions using Oxygen (past year)
- Less than 0.2% of 23,000+
- iPhone inactivity reboot window
- 72 hours
- Alleged Pegasus uses against lead El Faro plaintiff
- At least 226
- Russian nationals allegedly controlling Oxygen
- 5
Why CEOs should care
For CISOs and general counsel, the Oxygen case is a supply-chain question. Forensics and e-discovery tools see the most sensitive data a company holds, yet buyers rarely ask where the code is written or who owns the vendor. Ask your forensics, e-discovery and incident response suppliers to state their ownership and development locations in writing, and review contracts if the answers change.
For executives who travel, the GrayKey report shows that protections such as the 72-hour reboot can be worked around by commercial tools. Build a threat model that assumes a device may be seized at a border or lost: use loaner phones on high-risk trips, keep long alphanumeric passcodes, power devices off before crossings, and keep sensitive material off the handset where possible.
For boards, the Pegasus ruling is a reminder that legal remedies against spyware vendors are uncertain. Prevention, including Apple's Lockdown Mode for high-risk staff and fast software updates, matters more than recourse after the fact.
The bigger picture
Phone-extraction and spyware tools are sold mainly to governments and police, but their reach does not stop at criminal suspects. The El Faro suit concerned journalists; the Oxygen allegations involve software whose sister company sold to Russian intelligence. Companies whose leaders handle deal, legal or political information are part of the same risk picture.
What’s next
The Met's review of Oxygen and the US prosecution will determine whether UK forces keep using the software. The Knight Institute's appeal in the El Faro case will test again whether US courts can hear spyware claims from foreign targets.
What “Fact-checked” means
Fact-checking means testing a story’s facts against the evidence before it is published. This story went through at least two separate checks before this version was published.
- What we checked
- Its names, figures, dates, job titles, quotes and who said what were checked against the story’s sources, including its main source where it could be opened. The headline was checked for accuracy and overstatement.
- How
- A first check reviewed the whole story. If it passed, a second, skeptical check went back to the sources to look for mistakes in the most important facts. If a check flagged the story, it was edited to fix the problems found, and a separate re-check then reviewed the whole story again.
- Who
- The checks are made by our newsroom, as steps kept separate from the writing, under rules set by our editor, Hussein Mukhtar. A story the checks still flag is held for the editor, who decides whether it is fixed, published or dropped.
- If something is wrong
- “Fact-checked” does not mean error-free. If a material error is found after publication, we correct the story and add a note saying what changed. Report an error
Companies in this story
