Prosecutors say Virginia forensics vendor hid five Russian owners from DHS and the Department of War
Prosecutors charged Oxygen Forensics CEO Lee Reiber and Russian national Oleg Davydov with hiding five Russian owners from US agencies. The affidavit names four federal buyers, among them the Secret Service and the Department of War.
The Watch · Security desk
Timeline per the affidavit: August 2015, Reiber joins the company; March 2022, he is installed as CEO, president and board chairman; September 2022, Oxygen Software LLC becomes MKO Systems LLC; December 2022 and October 2023, Reiber falsely certifies no immediate or highest-level owner.
- 2015Reiber joins the company, claim 9
- 2022Reiber installed as CEO, president and board chairman, claim 16
- 2022Russian firm Oxygen Software LLC now MKO Systems LLC, claim 15
- 2022Reiber falsely certifies no immediate or highest-level owner, claim 18
- 2023Reiber again falsely certifies no such owner, claim 18
| Date | Event | Claim |
|---|---|---|
| August 2015 | Reiber joins the company | 9 |
| March 2022 | Reiber installed as CEO, president and board chairman | 16 |
| September 2022 | Russian firm Oxygen Software LLC now MKO Systems LLC | 15 |
| December 2022 | Reiber falsely certifies no immediate or highest-level owner | 18 |
| October 2023 | Reiber again falsely certifies no such owner | 18 |
What happened
- The affidavit says Oxygen Forensics presented itself as an independent US company while the five Russian owners held it through a holding company in Cyprus.
- The same five owned MKO Systems, formerly Oxygen Software LLC, whose Russian developers wrote the software that was sold in Russia under other product names, reportedly to the FSB.
- Davydov was arrested at London Heathrow before a flight to Istanbul, and the United States expects to seek his extradition.
- A magistrate judge's September 19 warrant led to seizure on September 20 of about 57 domains, along with corporate bank accounts and other infrastructure.
Why it matters
- exposure Agencies that bought on the company's certification hold a tool built to recover and analyze device data, and the affidavit places its developers in Russia.
- constraint With the Russian owners removed from public filings, a buyer reading those filings could not have found them. The vendor's own certification was the control that allegedly failed.
- decision In our view, buyers of forensic and security tools now have to decide whether a vendor's own ownership statement is enough or whether to ask for corroboration of ownership and development location.
Start with the dates. The affidavit says the concealment began after the United States expanded sanctions on Russia in early 2022 [20]. Reiber was installed as CEO, president and chairman in March 2022 [16], and the Russian owners were then removed from the company's public corporate filings [19]. His first alleged false certification, that Oxygen Forensics had no immediate or highest-level owner, came in December 2022, nine months after he took the title [18][10]. The second came in October 2023 [18]. The affidavit puts the conspiracy at March 2022 to the present [13].
The title did not carry control. According to the affidavit, the Russian owners kept making significant decisions. They decided what Reiber was paid, overrode his payment decisions and had signing authority over the company's bank accounts [17]. Davydov had been chief technology officer of the Russian company and was responsible for developing its software [9]. He helped establish Oxygen Forensics in Virginia in 2013, and Reiber joined in August 2015 [9].
All of this is allegation. The Justice Department described a criminal complaint and an affidavit, and the charge is conspiracy to commit wire fraud [4]. The link to Russian security services is secondhand: the affidavit says MKO's customers reportedly included the FSB, the Russian Investigative Committee and the Ministry of Internal Affairs [15].
On exploitability, the complaint makes no claim that the software carried malicious code, or that anyone used it to get unauthorized access to a customer's systems or data [5]. An operator has no indicator to hunt from this case. The charged conduct is false statements about who owned the company and where its software was developed [12].
The sources describe one company. They do not show a wider campaign, and we would not infer one. What carries over is the method. As alleged, the names on the filings and the CEO title changed while the same five owners kept control [17][14]. The certification is the document the affidavit says was false [18].
What to watch
- Reiber's arraignment in Los Angeles federal court, expected in the coming weeks, and whether he contests the charge.
- UK extradition proceedings for Davydov after his arrest at Heathrow.
- Whether any of the four named agencies says what it did with its Oxygen Forensics licenses and data.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence50
- Adoption40
- Hype gap−10
- Incentives55
- Confidence55
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
The CEO of a Virginia-based software company and a Russian national were arrested on a federal criminal complaint charging them with concealing from US government agencies that the company was owned and controlled by Russian nationals and that its software was developed in Russia.
- [2]
Lee Reiber, 55, of Boise, Idaho, was arrested in Idaho on Sunday, appeared in US District Court in Idaho on Tuesday and was released on bond; he is expected to be arraigned in Los Angeles federal court in the coming weeks.
- [3]
Oleg Sergeyevich Davydov, 52, of Moscow, was arrested on Sunday at London Heathrow Airport before boarding a flight to Istanbul, and the United States expects to seek his extradition.
- [4]
The defendants are charged with conspiracy to commit wire fraud.
- [5]
The complaint does not allege that the software contained malicious code or that it was used to gain unauthorized access to any customer's computer systems or data.
- [6]
On September 19 a federal magistrate judge in the Central District of California issued a warrant authorizing seizure of corporate bank accounts, approximately 57 domains and other cyberinfrastructure; the domains and related infrastructure were seized on September 20.
- [7]
The affidavit identifies the affected agencies as the US Department of War and three DHS components: the Secret Service and its National Computer Forensics Institute, Homeland Security Investigations, and the DHS Office of Inspector General.
- [8]
Digital forensic software is used to recover, preserve and analyze electronic data from digital devices while keeping the original files unchanged.
- [9]
Davydov was chief technology officer of the Russian company and responsible for the development of its software; he helped establish Oxygen Forensics in Virginia in 2013, and Reiber joined the company in August 2015.
- [10]
Reiber's first alleged false certification (December 2022) came nine months after he was installed as CEO (March 2022).
- [11]
Four federal buyers are named: the Department of War plus three DHS components.
- [12]
Reiber allegedly represented to the government that the company had no foreign ownership or control and that its software was developed in the United States, when five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia.
- [13]
According to the affidavit, from March 2022 to the present Reiber, Davydov and others conspired to obtain contracts from federal agencies through Oxygen Forensics Inc., a digital forensics company based in Alexandria, Virginia.
- [14]
According to the affidavit, Oxygen Forensics held itself out to the US government as an independent, US-based company, but Davydov and four other Russian nationals owned and controlled it through a holding company based in Cyprus.
- [15]
The same five individuals owned a Russian company, known until September 2022 as Oxygen Software LLC and now as MKO Systems LLC, which Davydov co-founded in 2000; the developers who wrote the software worked in Russia, and MKO sold it in Russia under different product names to customers that reportedly included the FSB, the Russian Investigative Committee and the Russian Ministry of Internal Affairs.
- [16]
Reiber was installed as the company's CEO, president and chairman of the board in March 2022.
- [17]
The company's Russian owners continued to make significant decisions, set Reiber's compensation, overruled him on payments and held signatory authority over the company's bank accounts.
- [18]
In December 2022 and October 2023, Reiber falsely certified to the US government that Oxygen Forensics had no immediate or highest-level owner.
- [19]
After the owners agreed to conceal ownership, the Russian owners were removed from the company's public corporate filings.
- [20]
After the United States imposed expanded sanctions on Russia in early 2022 over the invasion of Ukraine, Davydov, Reiber and the Russian co-conspirators agreed to conceal Oxygen Forensics' true ownership and the development of its software in Russia.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- justice.govalleging in September
1 article · October 14, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Federal procurement fraudFollow
- Software Supply Chain SecurityFollow
- Digital ForensicsFollow
- Russia sanctions evasionFollow