DoJ: US agencies bought forensics software from Russian operation that also supplied FSB

US defense and homeland security agencies bought digital forensics software built by the same Russian operation that supplied Moscow's security services, according to a criminal complaint announced by the US Department of Justice. Oxygen Forensics CEO Lee Reiber and Russian national Oleg Sergeyevich Davydov are charged with conspiracy to commit wire fraud over an alleged scheme to hide the company's Russian ownership and where its software was built.

Oxygen Forensics Inc., of Alexandria, Virginia, sold digital forensics tools to the US Department of War and three Department of Homeland Security components: the Secret Service and its National Computer Forensics Institute (NCFI), Homeland Security Investigations, and the DHS Office of Inspector General.

Hidden ownership

Prosecutors allege the company posed as an independent US business while five Russian nationals, including Davydov, owned and controlled it through a holding company in Cyprus. The same five owned a Russian firm known until September 2022 as Oxygen Software LLC, now MKO Systems LLC.

According to the affidavit, the developers who wrote the software worked in Russia, and MKO sold it there under other product names to customers reportedly including the FSB, the Russian Investigative Committee and the Russian Ministry of Internal Affairs. Davydov was the Russian firm's chief technology officer.

Sanctions and false certifications

After Washington expanded sanctions on Russia in early 2022 over the invasion of Ukraine, prosecutors say Reiber was installed as Oxygen's CEO, president and chairman that March, while the Russian owners left public corporate filings but still set his compensation and controlled company bank accounts.

Reiber certified in December 2022 and October 2023 that the company had no highest-level owner, and in July 2024 Oxygen told the Department of War that no foreign person could control its decisions. In November 2023 a reporter asked about its Russian ties; Reiber allegedly wrote to Davydov that coverage "could destroy this entire opportunity" — a pending NCFI contract — and that the company's "current existence ... hangs in the balance." NCFI awarded the five-year contract in September 2024.

Arrests, seizures and penalties

As recently as March 2026, Reiber told DHS personnel that no Russian was involved in building the software and no one in Russia could access its build environment, the complaint says. Prosecutors say a team in Russia under Davydov's direction wrote and managed the software, in a cloud environment run by one of the Russian owners.

Reiber, 55, was arrested in Idaho and released on bond. Davydov, 52, was detained at London Heathrow before boarding a flight to Istanbul, and the US plans to seek his extradition. Authorities also seized corporate bank accounts, roughly 57 domains and other cyber infrastructure. The complaint does not allege malicious code or unauthorized access; if convicted, each man faces up to 20 years, and both are presumed innocent.