The case involving US company Oxygen Forensics Inc has raised questions in Cyprus over how authorities scrutinise software developed, sold or exported through companies registered on the island.
The company came under scrutiny in the United States following prosecutions involving its executives. According to court documents filed in the US, Oxygen Forensics, which sells software used to extract data from electronic devices for forensic examination, is alleged to have concealed its true ownership structure.
Its 55-year-old chief executive is alleged to have told a US agency that the company was wholly American.
US investigators, however, allege that its parent company, Oxygen Forensics Ltd, is based in Cyprus and controlled by Russians with business dealings involving Russian state services, including the FSB.
There is no evidence that Oxygen Forensic Detective, the company’s software, contains malicious code.
The alleged corporate structure nevertheless raises wider questions over the way products of this kind are supervised and whether Cyprus has adequate mechanisms to protect national security and avoid becoming caught up in similar cases.
Software must be assessed case by case
Phileleftheros asked independent digital forensics expert and ISS Forensics director Alexis Mavros whether a company operating in this field could develop such software in Cyprus and sell it internationally.
“The registration of a company does not automatically mean that it is licensed to supply any product to any customer in any country,” Mavros said.
He added: “On the other hand, this does not mean that every data analysis programme requires a special licence. What the software does, where it is exported and what services are provided must be examined separately. There is also an important distinction: the commercial licence sold by the manufacturer allows the customer to use the product. It does not, however, replace any government licence that may be required for its sale or export. The fact that a company can issue an invoice does not necessarily mean that it can legally provide that particular technology to that particular customer.”
One unanswered question is whether Oxygen Forensics products were supplied to other countries through Cyprus.
Asked how such licensing works, Mavros pointed to EU Regulation 2021/821 on dual-use items and Cyprus Regulatory Administrative Act 528/2021.
“The main framework is EU Regulation 2021/821 on dual-use items and, in Cyprus, Regulatory Administrative Act 528/2021,” he said.
“These rules can, under certain conditions, cover equipment, software, technology, brokering and technical assistance, as well as some transfers within the EU. The Strategic Items Export Licensing Section of the Trade Service at the Ministry of Energy, Commerce and Industry is responsible for the relevant export licences.
“What matters is exactly what each product can do. Under specific conditions, the European control list includes equipment capable of extracting data from devices by bypassing access controls, as well as related software.
“This does not mean that every Oxygen product automatically requires a licence. Its technical characteristics must be examined.
“So the questions are specific: if the product was exported through Cyprus, was it assessed? Which rules applied? And, if a licence was required, was one in place?
“There are also general licences subject to specific conditions. The absence of an individual licence does not therefore, in itself, mean that anything illegal took place.”
Online delivery can also count as an export
Mavros said software supplied electronically to an organisation outside the EU could, depending on the circumstances, also fall within export rules.
“Yes, if the programme is downloaded, that can be considered an export. An export does not only mean that a product crosses customs in a box. The European Regulation also covers the electronic transmission or provision of software and technology outside the EU.
“That does not mean every software download requires a licence. It means electronic delivery is not automatically exempt from the rules.
“Calling it a ‘subscription’ or a ‘licence’ is not enough to determine whether the transaction is lawful. We need to know who supplied what, from where, to whom and for what use.”
Tax incentives are separate from security controls
Mavros was also asked whether companies developing this type of software in Cyprus may benefit from tax incentives.
“There is no general reduced VAT rate simply because a company is ‘technology-based’. The standard rate in Cyprus is 19%, while the tax treatment of transactions with other countries depends on the type of transaction, the customer and the place of supply.
“The IP Box is different. It is a tax regime that can, under certain conditions, reduce taxation on profits from intellectual property, including software. It provides an 80% exemption on qualifying net profits, subject to specific conditions linked to research and development.
“We have no information showing that this particular company used the regime.
“A tax incentive does not replace export or sanctions controls, nor does it mean that a product has undergone a security assessment. For tools that gain access to data or bypass protection mechanisms, those capabilities need to be examined specifically.”
Distributor describes data extraction capabilities
A distributor of Oxygen software that has repeatedly worked with Cyprus Police describes the product as a platform capable of extracting and analysing data from mobile devices, applications and cloud services.
“The Oxygen Forensics platform provides one of the most powerful digital investigation platforms, enabling fast, secure and in-depth extraction of data from mobile devices, applications and cloud services. With extensive device support, advanced decryption capabilities and powerful link-analysis tools, Oxygen transforms complex digital data into actionable intelligence,” the distributor says.
Could the manufacturer access customer data?
Mavros said the sale of forensic software does not in itself mean the manufacturer can access data analysed by the customer.
Such access could, however, become relevant if the company stores or processes data, or gains access through technical support or cloud services.
In those circumstances, he said, questions would arise over the capacity in which the company handles the data, whether the processing is lawful, how securely the data is held and whether it is transferred to other countries.
Personal data protection rules would apply, alongside specific provisions governing data used by law enforcement authorities.
Questions if Cypriot authorities used the software
If the software was used by Cypriot law enforcement agencies, Mavros said questions would need to be answered over how it was purchased, who provided technical support and what security checks were carried out.
Use of the product would not in itself mean that evidence had been altered, he said.
A forensic examiner should record which tool and version was used, the method followed and how the results were verified. Where technically possible, significant findings should also be independently confirmed.
Mavros said the question of the company’s activities in Cyprus existed independently of which Cypriot state agencies may have bought or used the software, and when.
Are Cyprus controls sufficient?
Mavros said Cyprus already has rules governing such activities, but the key questions concern which rules apply to the specific software and activity, whether they are sufficient and whether they were properly enforced.
He said it was not enough to say that a company was simply registered in Cyprus.
Authorities would need to establish exactly what the company did, who controlled it, who received its technology, which licences were required and what checks were carried out.
