US Seizes Oxygen Forensics Cyberinfrastructure in Russian Security Investigation

The U.S. Department of Justice recently arrested Lee Reiber, the CEO of Oxygen Forensics, and Oleg Sergeyevich Davydov, a Russian citizen. According to prosecutors, the duo schemed to hide Oxygen Forensics’ Russian background.

Reiber, a 55-year-old man from Boise, Idaho, was arrested there on 20th September before being released on bail. Davydov, aged 52, from Moscow, was arrested at London Heathrow Airport before a flight out of the country. He is now expected to be extradited.

Both men are facing conspiracy to commit wire fraud charges, and if guilty, could be looking at up to 20 years in prison.

DOJ Says Russian Owners Controlled Oxygen

According to the criminal complaint, five Russian nationals own & control Oxygen Forensics through a holding company in Cyprus.

Oxygen Forensics is a US-based company, based in Alexandria, Virginia; it makes software that helps investigators recover, preserve, and get to the bottom of data from mobile phones and other digital devices.

Prosecutors say the founders presented the company to the US government as an independent US business. But the Russian owners were still pulling the strings on key business decisions.

Reiber became CEO, president and board chairman in March 2022. Around that time, the company removed the Russian owners from its public corporate filings. The complaint says those owners still made major decisions, set Reiber’s pay, overruled payments and kept signatory authority over company bank accounts.

The same five people allegedly owned a Russian company known as Oxygen Software LLC until September 2022. It later became MKO Systems LLC.

Davydov co-founded that company in 2000. He served as the company’s chief technology officer. Prosecutors say developers in Russia continued to write and manage the software.

U.S. Agencies Bought the Software

The affidavit identifies several U.S. government customers affected by the alleged scheme. They include the U.S. Secret Service and its National Computer Forensics Institute, Homeland Security Investigations, the DHS Office of Inspector General and the Department of War.

The NCFI awarded Oxygen Forensics a five-year contract in September 2024. Reporting on federal procurement records puts the contract ceiling at $12 million. The DOJ says the award file included a certification from Reiber stating that the company had no immediate or highest-level owner.

Prosecutors say Reiber had made similar certifications in December 2022 and October 2023.

In July 2024, Oxygen Forensics also certified to the Department of War that no foreign person could control its directors, managers or company decisions. The complaint says that was false. Prosecutors allege the Russian owners still controlled the company. One Russian owner had also joined the board under a Turkish identity.

The alleged misrepresentations continued in 2026. In March, Reiber reportedly told DHS personnel that no Russians worked on the software and that people in Russia could not access its development environment.

Prosecutors say the opposite was true. They allege a Russian team wrote, reviewed, and managed the software under Davydov’s direction.

Russian Government Customers Add Concern

The DOJ says the same five Russian owners also controlled MKO Systems. That company allegedly sold related forensic software in Russia. Customers reportedly included Russia’s Federal Security Service, or FSB, the Russian Investigative Committee and the Ministry of Internal Affairs.

The DOJ does not allege that the Russian government directs Oxygen Forensics, nor did it say the company’s software has malicious code. The criminal complaint actually says there’s no claim that the software somehow allowed people to access customer systems or data without permission.

Instead, the case is all about alleged deception surrounding who really owns the company & who’s actually calling the shots in terms of software development.

Federal Authorities Seize Oxygen Infrastructure

The investigation also led to a major seizure. On September 19, a federal magistrate judge authorized the seizure of Oxygen Forensics’ corporate bank accounts, about 57 domains and other cyberinfrastructure tied to the alleged conduct.

Federal authorities carried out the seizure on September 20. The Department of Commerce’s Bureau of Industry and Security is investigating the case. The Department of War’s Office of Inspector General Defense Criminal Investigative Service is also assisting in solving the case.

The DOJ’s Office of International Affairs is also helping with Davydov’s expected extradition.

Why the Case Matters

The allegations put attention on a basic issue in government technology buying: who owns and controls a vendor.

Digital forensics tools can handle sensitive evidence from phones, computers, and other devices. Other recent incidents show how sensitive personal records can create serious security concerns when exposed. For example, the alleged Bayut data breach exposes passport scans and property ownership records and examines claims involving highly sensitive identity and property information. That makes ownership, development location, and access controls important parts of the trust decision.

The DOJ case does not establish that U.S. government data was compromised. It does, however, allege that agencies received false information about the company behind the software.

That could very well give rise to a security issue – even without any malicious code being involved. For now, the allegations remain unproven; the Justice Department still maintains that both defendants are considered innocent until such time as they’re proven guilty in court.

The case will now move on into federal court as US authorities press for Davydov’s extradition.