Prosecutors Charge Two Executives Over Concealed Ties Behind Government Forensics Contractor

U.S. authorities have arrested two executives connected to digital forensics provider Oxygen Forensics, alleging that the company concealed Russian ownership and Russia-based software development while securing contracts with sensitive American government agencies.


The Justice Department charged Lee Reiber, 55, chief executive of Virginia-based Oxygen Forensics, and Oleg Sergeyevich Davydov, 52, a Russian national, with conspiracy to commit wire fraud.


Reiber was arrested in Idaho and later released on bond. Davydov was detained at London's Heathrow Airport before a flight to Istanbul, and U.S. authorities intend to seek his extradition.


Neither defendant has been convicted, and the allegations remain subject to court proceedings.


Prosecutors Allege Five Russians Controlled the Company

According to the criminal complaint, Oxygen presented itself to federal customers as an independent American business with software developed in the United States.
Prosecutors allege the reality was different.


Five Russian nationals, including Davydov, allegedly owned and controlled Oxygen through a Cyprus-based holding structure while developers in Russia built the company's digital-forensics technology.


The same five individuals also owned a Russian business formerly known as Oxygen Software LLC, now MKO Systems LLC. According to DOJ, that operation sold forensic technology to Russian government customers, reportedly including the Federal Security Service (FSB), Investigative Committee and Ministry of Internal Affairs.


Ownership Structure Allegedly Changed After 2022 Sanctions

The alleged concealment intensified after Russia's invasion of Ukraine triggered expanded U.S. sanctions in 2022.


DOJ says Reiber became Oxygen's CEO, president and board chairman in March 2022, while Russian owners disappeared from public corporate filings.


Investigators Say Control Continued Behind the Corporate Structure

Federal investigators allege that the ownership changes did not reflect the company's actual decision-making structure.


The Russian owners allegedly continued making significant business decisions, determining Reiber's compensation, overruling him on payments and maintaining authority over company bank accounts.


Reiber allegedly certified to the U.S. government in December 2022 and October 2023 that Oxygen had no immediate or highest-level owner.
Investigators further allege that Oxygen later certified to the Defense Department that no foreign person controlled company management or decision-making.


Sensitive Federal Agencies Purchased the Technology

The allegations carry particular significance because Oxygen sells tools designed to extract and analyze information from electronic devices.


Since March 2022, the company's software has been sold to organizations including the U.S. Secret Service, Homeland Security Investigations, the DHS Office of Inspector General and the Defense Department, according to federal authorities.


Oxygen also secured a five-year contract in September 2024 involving the Secret Service's National Computer Forensics Institute.
Procurement officials told investigators they would not have awarded or renewed contracts had they known the company was Russian-owned or controlled, according to the complaint.


Federal Authorities Seized Accounts and Dozens of Domains

The enforcement action extends beyond the two arrests.
On September 19, a federal magistrate judge authorized the seizure of corporate bank accounts, approximately 57 internet domains and other cyber infrastructure allegedly connected to the scheme.
The infrastructure was seized the following day.


Those actions indicate that investigators are treating the case not merely as a disputed corporate disclosure, but as an alleged multiyear procurement-fraud operation involving technology supplied to national-security and law-enforcement customers.


DOJ Does Not Allege a Software Backdoor

One distinction is essential.
The criminal complaint does not allege that Oxygen's products contained malicious code, backdoors or other mechanisms designed to compromise U.S. customers.


Nor does DOJ allege that the software was used to obtain unauthorized access to government systems or customer data.


The immediate case concerns alleged deception surrounding ownership, corporate control and where the technology was developed.


Case Exposes a Deeper Software Supply-Chain Problem

The broader security issue is therefore one of technology provenance and procurement assurance.


Digital-forensics software operates in unusually sensitive environments. Its capabilities can include extracting information from smartphones, computers, cloud accounts and other electronic devices, meaning government buyers must understand not only what the software does but also who develops it, who controls the supplier and which foreign entities may influence its operations.


The Oxygen case demonstrates a limitation of conventional procurement security: technical testing alone cannot identify every supply-chain risk.


A product can contain no known malware while still presenting national-security concerns if its ownership, development environment or corporate control differs materially from what customers were told.


For government security teams, the case reinforces a broader principle: software provenance must be continuously verified rather than treated as a disclosure checked once during procurement. Ownership, development personnel, financial control and foreign influence can change while the same technology remains embedded inside sensitive operations.