The scandal with the American company Oxygen Forensics Inc inevitably brings to the fore questions concerning control mechanisms by services of the Republic in relation to software.
This legal entity came to the fore in the US after prosecutions were made against its executives. As can be seen for the time being from a case file brought before a US Court, the company that sells software for extracting data from electronic devices for the purposes of forensic examinations, appears to have concealed its true ownership status.
Covert
Its 55-year-old CEO reportedly told a US agency that it is a purely American company. However, its parent company, based on the investigations of US authorities, is based in Cyprus (Oxygen Forensics ltd) and is controlled by Russians who deal with services in their country such as the FSB counterintelligence service.
The risks
Oxygen's software ("Oxygen Forensic Detective") has not been proven to contain malicious code. Nevertheless, its allegedly covert corporate structure inevitably leads us to a search for such products, but also how Cyprus can exercise effective control to avoid the possibility of endangering its national security, but also not finding itself in the vortex of a new scandal.
"To be examined"
"F", attempting to give the dimensions that the issue has for Cyprus, turned to the independent digital forensics expert and director of ISS Forensics, Alexis Mavros.
In his initial statement, Mr. Mavros was asked to tell us whether a company with such a turnover can develop such software on our island and make it available internationally.
"The registration of a company does not automatically mean that it is licensed to sell any product, to any customer and in any country," said Mr. Mavros boldly.
He added, however, that "on the other hand, it does not mean that every data analysis program needs a special license. It must be considered separately what the software does, where it is exported, and what services are provided. There is also an important difference: the commercial license sold by the manufacturer allows the customer to use the product. However, it does not replace any government authorization required for its sale or export. The fact that a company can issue an invoice does not necessarily mean that it can legally make this technology available to that customer."
"Was it exported through Cyprus?"
One of the questions, which has not yet been answered, is whether the Oxygen Forensics product was available in other countries through our island. The next question to Mr. Mavros, therefore, is the procedure for issuing such permits in Cyprus.
"A key framework is the EU Regulation 2021/821 on dual-use items and, in Cyprus, the Regulatory Administrative Act 528/2021," said Alexis Mavros and explained: "These rules may, under certain conditions, cover equipment, software, technology, brokerage and technical assistance, and even certain intra-EU transport. For the relevant export licenses, the Branch for the Issuance of Export Licenses of Strategic Items of the Trade Service, at the Ministry of Energy, Commerce and Industry, is responsible. What matters is exactly what each product can do. The European Checklist includes, under certain conditions, equipment that can extract data from devices bypassing access controls, as well as related software. This does not mean that every Oxygen product automatically needs a license. Its technical characteristics need to be examined. So, the questions are specific: If the product was exported through Cyprus, has it been examined? What rules were in force? And, if permission was needed, was there? There are also general licenses with specific conditions. Therefore, the fact that there is no individual license does not in itself mean that something illegal has been done."
Elsewhere in his statements, the forensic expert told us that even if a product is "downloaded" online from a service in a non-EU country, it can be considered an export: "Yes, if the program downloads, it can be considered an export. Exporting doesn't just mean that a product goes through customs inside a box. The European Regulation also covers the electronic sending or making available of software and technology outside the EU. This does not mean that every download of a program needs permission. It means that online delivery is not automatically exempt from the rules. Whether it is called a "subscription" or a "license" is not enough to judge whether the transaction is legitimate. We need to know who gave what, from where, to whom and for what use."
Tax incentives
Our next question to Mr. Mavros has to do with possible tax incentives that companies that produce such software have in Cyprus: "There is no general reduced VAT because a company is "technological". The standard rate in Cyprus is 19%, while in transactions with other countries the method of taxation depends on the type of transaction, the customer and the place of supply. IP Box is something different. This is a tax regime that can, under certain conditions, reduce the taxation of profits from intellectual property, including software. It provides for an 80% discount on eligible net profits, under specific conditions linked to research and development. We have no evidence that this company used this regime. A tax incentive does not replace controls on exports and sanctions, nor does it mean that the product has been checked for safety. For tools that gain access to data or bypass protection mechanisms, it is precisely these capabilities that need to be considered."
The description of the software
A well-known distributor of Oxygen software that has repeatedly collaborated with the Cyprus Police, presents details on the use of the software and the capabilities it provides: "Oxygen Forensics provides one of the most powerful digital investigation platforms, enabling fast, secure and in-depth data extraction from mobile devices, applications and cloud services. With extensive device support, advanced decryption capabilities, and powerful correlation analysis tools, Oxygen transforms complex digital data into actionable intelligence."
Can the manufacturing company have access...
A manufacturer that sells such software in a country, under certain conditions, can access data from the service of the country to which it contracts its product.Can the manufacturer access the data analyzed by an agency in a country to which it sold software?
Under conditions. Selling a piece of software doesn't in itself mean that the company that built it can see the customer's data. But if it stores or processes it, or accesses it through technical support or cloud services, then it needs to be considered in what capacity it manages it, whether the processing is legal, how secure the data is and whether it is transferred to other countries. Personal data protection rules and special rules apply when data is used by prosecuting authorities.If the software was used by Cypriot prosecuting authorities?
Then they need answers about how it was purchased, who provided technical support and what security checks were carried out. The use of the product does not in itself mean that evidence has been tampered with. The examiner must record which tool and version he used, by what method and how he confirmed the results. Where technically possible, significant findings must also be independently confirmed. The issue of the company's activity in Cyprus, however, exists regardless of which Cypriot state services purchased and use this software and from when.Is there an adequate legal framework on our island? Are the necessary checks being carried out?
There are rules. The question is which of them are applied to the specific software and activity, whether they are adequate and whether they were implemented correctly. It is not enough to answer that "the company is simply registered in Cyprus". We need to know exactly what it did, who controlled it, to whom it gave its technology, what licenses were needed and what controls were carried out.
