DOJ: Oxygen Forensics executives falsely certified US ownership to win government contracts
Federal authorities arrested Oxygen Forensics' CEO and CTO, alleging they hid Russian ownership to win over $2 million in Secret Service work. DOJ does not allege malicious code, so agencies running the tool are left weighing who controls it and the same software's sale to Russia's FSB.
The Watch · Security desk
What happened
- The Justice Department arrested Oxygen Forensics CEO Lee Reiber in Idaho and CTO Oleg Davydov in London and charged both with conspiracy to commit wire fraud.
- Prosecutors say five Russian nationals controlled Oxygen through a Cyprus holding company and removed their names from its filings after the 2022 sanctions.
- After those sanctions, Oxygen won more than $2 million in contracts and purchases from the Secret Service and its National Computer Forensics Institute, according to the complaint.
- On September 20, authorities seized about 57 of the firm's domains along with its cyber infrastructure and corporate bank accounts.
Why it matters
- Who's exposed exposure Agencies still running Oxygen have no malware allegation to act on, so their review turns on whether to keep tooling the complaint ties to the same team and owners that supplied Russia's FSB.
- Who has to decide decision Renewals of Oxygen contracts at DHS and DOD, including NCFI's five-year deal, go to officials who say, per the complaint, they would not have bought from a Russian-owned firm.
- What it sets up precedent Charging false ownership certifications as wire fraud with a 20-year maximum puts criminal liability behind the foreign-control answers vendors self-certify on federal contracts.
Next story · Invest · Oct 2
Supreme Court's 6-3 order keeps third-country deportations running into 2027Confirmed3 publishers
Prosecutors built the case on ownership certifications [8]. NCFI's filing for its five-year deal, signed in September 2024, noted that Reiber had certified Oxygen had no "immediate or higher level owner" [7]. Almost a year later, prosecutors say, Oxygen certified to the Defense Department that "no foreign person had the power to control the appointment of the company's directors or managers or to direct its other decisions or activities" [8]. Reiber asserted U.S. ownership to NCFI as recently as February, according to the complaint [10]. In 2026 he allegedly told DHS officials that no Russians were involved in making the software [9]. A DOJ affidavit says that in fact "five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia" [17].
The public record shows the certifications were accepted, but not what, if anything, contracting officers did to test them [7]. Questions were already public. In November 2023 a journalist asked Reiber about the Russian ties, and he allegedly wrote to Davydov that media attention "could destroy this entire opportunity" [19]. Prosecutors say that opportunity was the pending NCFI contract [19]. NCFI signed it about ten months later [27]. That same year, Oxygen faced accusations that its U.S. and Russian arms both used code reverse-engineered from Elcomsoft products [24].
Prosecutors date the concealment to the sanctions that followed Russia's 2022 invasion of Ukraine. Reiber became CEO, president and chairman in March 2022, shortly before the filings changed [5]. The owners kept running the company. "The company's Russian owners continued to make significant decisions and set Reiber's compensation, overruled him on payments, and held signatory authority over the company's bank accounts," the DOJ press release said [6]. An unnamed co-conspirator quoted in the complaint said "fateful decisions will be made by" five shareholders, Davydov among them [18].
For a responder, DOJ's own limits set the scope. "The complaint does not allege that the software contained malicious code or that it was used to gain unauthorized access to any customer's computer systems or data," the department said [13]. No implant is alleged, so the case gives defenders nothing to sweep endpoints for. The exposure is provenance. The complaint says Oxygen US and Oxygen Russia "sold the same software, developed by the same team, and were owned by the same people" [21]. Russia's FSB, its Investigative Committee and its Interior Ministry bought that software under another name from a separate Davydov company, according to DOJ [12]. Oxygen has said its tools extract and analyze data from cloud accounts, drones and mobile devices [25].
The buyers' position is on record. "Procurement officials at the U.S. government customers have represented that they would not have awarded or renewed contracts for the forensic software had they known that OxygenUS was a Russian-owned company," the complaint reads [20]. Oxygen reportedly holds nearly 10,000 contracts in more than 150 countries [28]. Its website has been seized and is down [23].
Natalia Krapiva, senior tech legal counsel at Access Now, has pressed the issue for years. "For years, civil society warned that Oxygen Forensics was owned and built from Russia. Now the Justice Department confirmed it," she told CyberScoop [15]. "No surveillance tool should come anywhere near a US investigation until we know who owns it, who builds it, and who else they are selling to," Krapiva said [14]. Access Now wants the U.S. and the more than 100 governments it says use the technology to cut ties with the company [16]. Reiber's court-listed attorneys did not respond to CyberScoop, and no attorney for Davydov could be located [26].
What to watch
- Whether a UK court grants the US request to extradite Davydov, the Moscow-based CTO arrested in London.
- Whether DHS or NCFI suspends or ends the five-year Oxygen contract signed in September 2024, or tells field units to stop using the tool.
- Whether an indictment adds technical findings about the software; the current complaint alleges no malicious code or unauthorized access.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence60
- Adoption45
- Hype gap+12
- Incentives55
- Confidence62
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The Justice Department announced Wednesday that it arrested two principals of Oxygen Forensics, CEO Lee Reiber (arrested in Idaho) and CTO Oleg Davydov (arrested in London); both were charged with conspiracy to commit wire fraud.
- [2]
Davydov, a 52-year-old Moscow resident and Oxygen's chief technology officer, was arrested in London; federal authorities plan to seek his extradition to the U.S.
- [3]
Both men were charged with conspiracy to commit wire fraud and face up to 20 years in prison.
- [4]
Prosecutors said Davydov and four other Russian nationals hid behind a holding company based in Cyprus, though Oxygen is formally headquartered in Virginia; Oxygen removed the Russians' names from its corporate filings after the 2022 sanctions.
- [5]
Prosecutors say the scheme was developed after Russia invaded Ukraine and the U.S. imposed new sanctions; Reiber became CEO, president and chairman of the board in March 2022, soon before the corporate filings were changed.
- [6]
"The company's Russian owners continued to make significant decisions and set Reiber's compensation, overruled him on payments, and held signatory authority over the company's bank accounts,"
- [7]
In September 2024, the NCFI signed a five-year deal with Oxygen, noting in its filing that Reiber had certified that Oxygen had no "immediate or higher level owner."
- [8]
Almost a year after the NCFI deal, prosecutors say, Oxygen certified to the Department of Defense that "no foreign person had the power to control the appointment of the company's directors or managers or to direct its other decisions or activities."
- [9]
In 2026, Reiber allegedly told DHS officials that no Russians were involved in making its software.
- [10]
Reiber asserted U.S. ownership as recently as February of this year to the NCFI, according to the complaint.
- [11]
After the 2022 sanctions, Oxygen won more than $2 million in contracts and purchases from the Secret Service and its National Computer Forensics Institute.
- [12]
Russia's FSB, the Russian Investigative Committee and the Russian Ministry of Internal Affairs bought software from a separate Davydov company selling the same software under a different name.
- [13]
"The complaint does not allege that the software contained malicious code or that it was used to gain unauthorized access to any customer's computer systems or data."
- [14]
"No surveillance tool should come anywhere near a US investigation until we know who owns it, who builds it, and who else they are selling to,"
- [15]
"For years, civil society warned that Oxygen Forensics was owned and built from Russia. Now the Justice Department confirmed it,"
- [16]
Krapiva called on the U.S. and over 100 governments using the technology to immediately sever all ties to the company.
- [17]
According to a DOJ affidavit, Reiber told agencies "its software was developed in the United States, when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia."
- [18]
An unnamed co-conspirator in the complaint said that "fateful decisions will be made by" five shareholders, including Davydov.
- [19]
In November 2023, a journalist asked Reiber about the Russian ties, prompting him to allegedly write to Davydov that media attention "could destroy this entire opportunity"; prosecutors allege the opportunity was a pending contract with the NCFI.
- [20]
"Procurement officials at the U.S. government customers have represented that they would not have awarded or renewed contracts for the forensic software had they known that OxygenUS was a Russian-owned company,"
- [21]
The complaint says answering the Elcomsoft accusation truthfully "would have required disclosing that Oxygen US and Oxygen Russia sold the same software, developed by the same team, and were owned by the same people."
- [22]
On September 20, U.S. authorities seized about 57 domains, cyber infrastructure and corporate bank accounts belonging to the firm.
- [23]
Oxygen's website has been seized by authorities and is down.
- [24]
In 2023 Oxygen faced accusations that Oxygen US and Oxygen Russia were both using software code reverse-engineered from Elcomsoft's products.
- [25]
The company has previously said its tools allow investigators to extract and analyze digital data from sources including the cloud, drones and mobile devices.
- [26]
Court-listed attorneys for Reiber did not respond to requests for comment, and no attorney for Davydov could be located.
- [27]
NCFI signed the contract about ten months after Reiber's November 2023 message about media attention.
- [28]
The firm reportedly has nearly 10,000 contracts in more than 150 countries.
Sources
2 independent publishers whose own reporting we read for this story.
- cyberscoop.comPhone-hacking company that won U.S. security agency contracts hid Russian ownership, DOJ alleges
1 article · September 24, 2026
- therecord.mediaDigital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges
1 article · September 24, 2026
Topics and entities
Topics
- Software Supply Chain Security
- Digital Forensics
- Russia Sanctions Regimes
- Government contracting fraud
Entities
- United States Secret Service
- Access Now
- U.S. Department of Justice
- US Department of Homeland Security
- Pentagon
- National Computer Forensics Institute
- Federal Security Service of Russia
- Oxygen Forensics