Oxygen Forensics Executives Arrested for Hiding Russian Ownership
U.S. prosecutors charged Oxygen Forensics CEO Lee Reiber and CTO Oleg Sergeyevich Davydov with conspiracy to commit wire fraud under 18 U.S.C. § 1349 for concealing Russian ownership and Russia-based development from federal buyers. Reiber was arrested in Idaho and Davydov was arrested at London Heathrow; prosecutors have not alleged malware in the software.
Indictment and arrests
A U.S. federal indictment describes a multi-year supply-chain fraud in digital forensics. Oxygen Forensics presented itself as a U.S. vendor while Russian citizens held full ownership and the core development team worked in Russia. Prosecutors say layered companies, altered corporate filings, and false qualification documents were used to win orders from the Department of Defense, the Department of Homeland Security, the U.S. Secret Service, and other agencies.
Two executives were arrested on a charge of conspiracy to commit wire fraud, in violation of 18 U.S.C. § 1349. Lee Reiber, 55, a U.S. citizen and chief executive, was arrested in Idaho. Oleg Sergeyevich Davydov, 52, a Russian citizen, co-founder, and chief technology officer, was arrested at London Heathrow Airport while preparing to fly to Turkey.
Prosecutors have not alleged that the software contains malicious code. They have not presented evidence that outsiders gained unauthorized access to customer computers or core data. The charges concern concealment of ownership and of where the software was developed.
Oxygen Forensics was a leading digital forensics vendor. Its site listed partners including the Internal Revenue Service, the U.S. Army, DHS, and the Department of Justice. The site could not be reached after the case became public.
Three-entity structure and dual brands
The group, internally called CO3, had three legal entities: Oxygen Forensics Inc (OXYGEN US) in Alexandria, Virginia, for the U.S. market; Oxygen Forensics Ltd (OXYGEN CYPRUS), registered in Cyprus, as the holding layer; and MKO-Systems LLC (OXYGEN RUSSIA), formerly Oxygen Software, for Russian development and domestic sales.
Five Russian shareholders controlled all three. OXYGEN US was 100 percent owned by OXYGEN CYPRUS, and those five shareholders were the beneficial owners of OXYGEN CYPRUS. OXYGEN RUSSIA customers included the Federal Security Service (FSB), the Investigative Committee, and the Interior Ministry. Prosecutors say the Russian and U.S. products shared the same codebase under different names.
In Russia the software was sold as MK Desktop, MK Expert Plus, and MK Enterprise. Internationally it was sold as Oxygen Forensics Detective, Oxygen Review Center, and Oxygen Remote Explorer.
Other vendors in the concentrated market include Cellebrite (Israel); Susteen, Paraben, and BlackBag Technologies (United States); and Magnet Forensics (Canada). Oxygen Forensics' Russian background was reported in the trade press as early as 2016.
Concealment after 2022
After the 2022 escalation of the Russia-Ukraine war and tighter U.S. sanctions, the shareholders moved to strip Russian names from U.S. records. In March 2022 they removed Russian shareholders from OXYGEN US public filings, appointed Reiber as chief executive and board chair, and amended the charter so major decisions remained with the Russian shareholders. In June 2022 a second amended annual report deleted remaining Russian executive registrations.
In November 2024, one core shareholder re-entered OXYGEN US management as president and board chair under the name Fatih Osman, using a Turkish passport obtained in 2023.
A Virginia lawyer who filed the corporate papers is alleged to have violated Office of Foreign Assets Control rules in force from June 2022 that bar U.S. persons from providing company-formation agent services to Russian entities. Prosecutors say the lawyer also recruited two U.S. citizens as nominee directors.
On development location, prosecutors say the Russian team completed coding, review, and management in Russia and moved only the final compile and build to U.S. Amazon Web Services infrastructure, where Reiber ran a one-click script so the company could claim a U.S. build. Davydov led the Russian team.
Reiber was already on notice. In 2018 the General Services Administration flagged that source code was developed outside the United States, and the company then left the GSA schedule. In 2024, for European government buyers, sales staff said public statements should not mention Russian employees. Reiber then changed an official letter to say compile, coordination, code review, software build, and customer deployment all occurred in Virginia.
False federal filings and the NCFI contract
Federal suppliers must file annual Representations and Certifications in the System for Award Management (SAM) disclosing direct and ultimate owners. From August 2022 through September 2025, Reiber filed false SAM certifications. He first claimed the company had no direct or highest-level owners. He later admitted the Cyprus company as a direct shareholder but still denied any higher-level beneficial owner.
On Department of Defense Form SF-328 (Certificate Pertaining to Foreign Interests), the company answered no to non-U.S. directors, officers, or core managers, and no to foreign control of decisions.
On those filings, the Secret Service National Computer Forensics Institute (NCFI) awarded in September 2024 a five-year indefinite-delivery, indefinite-quantity contract with a $12 million ceiling. More than $1.46 million was paid in 2024 and 2025. A contracting official later said the government would not have awarded or renewed the contract if it had known the company was Russian-owned.
Internal control and money flows
Investigators using search warrants obtained internal mail, shared files, cloud logs, and bank records. Shareholders used shared files they called general staff documents to discuss strategy, compliance, and sanctions avoidance. Russian shareholders set CEO pay, approved major spending, held bank signatory authority, and set the product roadmap.
In an April 2024 message, a core shareholder froze Reiber's salary because U.S. payments to Cyprus were late, and wrote that as Reiber's boss he should have all company information Reiber held. Reiber then opened the related system access.
From June 2022 to January 2026, OXYGEN US sent 128 transfers totaling more than $19.05 million to the Cyprus company, labeled as copyright and license fees at 50 percent of U.S. revenue. Seventy-four transfers were round amounts between $100,000 and $300,000. The Cyprus company had no development staff and did not build product. Funds ended with the five Russian shareholders.
Citadel plans and later denials
From February to May 2023, shareholders discussed three Russian government involvement options under the name Citadel. One kept shareholder ownership while assisting Russian monitoring, and considered an FSB-linked body holding shares in the Russian company if the arrangement stayed secret. A second had the Russian government take over the Russian entity while shareholders kept overseas business. A third, rated least likely because sanctions would destroy overseas sales, had the Russian government take over the whole group.
In late 2023, after media questions, Reiber wrote that exposure would sink the NCFI contract and threaten the company's survival. His proposed response was to cut visible ties to the Russian entity and deny the link.
In February 2026, after further reporting that Oxygen US was Russian-controlled, executives wrote NCFI calling the claims false accusations from a dismissed employee. In March 2026, on a call with an undercover agent posing as a DHS buyer, Reiber denied Russian ownership, Russian developers, and Russian access, and said none of those conditions had existed since 2022. The company also launched a trust-themed site stating it was not controlled by persons in restricted jurisdictions and did not develop software in restricted regions.
Additional reporting
Open-source follow-up has stated that FBI, DEA, ICE, and the State Department held a three-year contract with the firm, and has described the company as founded by a former FSB officer and focused on geolocation and recovery of deleted smartphone data.
The same follow-up links group investor Eduard Bendersky to former FSB Vympel service. Separately, Jeffrey Epstein obtained a 2011 Russian visa listing Moscow's MOO Vympel as the inviting organization. Vympel is a name used by an FSB special forces unit; a veterans group page linked to the MOO Vympel site. Former FSB academy graduate Sergey Belyakov helped arrange the Vympel veterans invitation in 2011 and a pension-union invitation in 2018.
Digital forensics tools handle communications, location data, and encrypted files. The case turns on ownership and development-location disclosures in federal buying, not on a charged software implant. U.S. agencies are expected to apply deeper beneficial-owner and development-site checks for forensics and related security tools.