The US Department of Defense and multiple Department of Homeland Security agencies purchased digital forensics software from a company whose development team in Russia also built tools sold to Moscow's security services, according to federal prosecutors. The Department of Justice announced the arrests of Oxygen Forensics CEO Lee Reiber and Russian national Oleg Sergeyevich Davydov on charges of conspiracy to commit wire fraud. Authorities allege the pair orchestrated a scheme to conceal the Virginia-based company's Russian ownership and the true origin of its software products.
Prosecutors say Oxygen Forensics marketed digital forensics tools to the Department of War and several DHS components, including Homeland Security Investigations, the DHS Office of Inspector General, and the Secret Service's National Computer Forensics Institute. The company presented itself as an independent American business, but was actually controlled by five Russian nationals through a Cyprus-based holding company, according to the indictment. Those same five individuals also owned a Russian entity formerly called Oxygen Software LLC, now operating as MKO Systems LLC. Federal authorities claim the software developers who created the products worked in Russia, while MKO marketed the same technology under different product names to Russian government clients including the FSB, the Russian Investigative Committee, and the Russian Ministry of Internal Affairs.
The alleged deception intensified after Russia's 2022 invasion of Ukraine prompted expanded US sanctions, according to the DOJ. Reiber was appointed as Oxygen's CEO, president, and chairman, while the Russian owners vanished from public corporate records yet continued exercising control over major decisions—setting Reiber's pay, overriding him on payments, and maintaining signatory rights on company bank accounts. When a journalist inquired about Oxygen's Russian connections in 2023, Reiber reportedly warned the owners that the resulting news coverage "could destroy this entire opportunity," referring to a contract the firm was pursuing with the National Computer Forensics Institute. He added that Oxygen's "current existence ... hangs in the balance." The NCFI subsequently awarded Oxygen a five-year software contract in September 2024. Prosecutors allege Oxygen separately assured the Department of Defense that no foreign person held power to control the company or its decisions. As recently as March 2026, Reiber allegedly told DHS personnel that no Russian participated in software development and nobody in Russia could access its build environment, though the DOJ claims a Russian team under Davydov's supervision actually wrote and managed the software.
Reiber was taken into custody in Idaho, while Davydov was apprehended at London's Heathrow Airport before boarding a flight to Istanbul. The US government plans to seek Davydov's extradition. Authorities also seized corporate bank accounts, approximately 57 domains, and additional infrastructure. The DOJ clarified it isn't claiming Oxygen's software contained malicious code or was exploited to gain unauthorized access to customers' systems or data. If convicted, both defendants face maximum sentences of up to 20 years in prison. The case highlights the vulnerability of supply chain integrity when procurement processes rely on corporate representations rather than independent verification of development provenance. For agencies handling sensitive investigative tools, the distinction between stated ownership and operational control can create security exposures that persist undetected for years.