DOJ: Oxygen Forensics executives falsely certified US ownership to win government contracts

Prosecutors built the case on ownership certifications ^[9]. NCFI's filing for its five-year deal, signed in September 2024, noted that Reiber had certified Oxygen had no "immediate or higher level owner" ^[8]. Almost a year later, prosecutors say, Oxygen certified to the Defense Department that "no foreign person had the power to control the appointment of the company's directors or managers or to direct its other decisions or activities" ^[9]. Reiber asserted U.S. ownership to NCFI as recently as February, according to the complaint ^[11]. In 2026 he allegedly told DHS officials that no Russians were involved in making the software ^[10]. A DOJ affidavit says that in fact "five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia" ^[26].

The public record shows the certifications were accepted, but not what, if anything, contracting officers did to test them ^[8]. Questions were already public. In November 2023 a journalist asked Reiber about the Russian ties, and he allegedly wrote to Davydov that media attention "could destroy this entire opportunity" ^[12]. Prosecutors say that opportunity was the pending NCFI contract ^[12]. NCFI signed it about ten months later ^[13]. That same year, Oxygen faced accusations that its U.S. and Russian arms both used code reverse-engineered from Elcomsoft products ^[25].

Prosecutors date the concealment to the sanctions that followed Russia's 2022 invasion of Ukraine. Reiber became CEO, president and chairman in March 2022, shortly before the filings changed ^[6]. The owners kept running the company. "The company's Russian owners continued to make significant decisions and set Reiber's compensation, overruled him on payments, and held signatory authority over the company's bank accounts," the DOJ press release said ^[7]. An unnamed co-conspirator quoted in the complaint said "fateful decisions will be made by" five shareholders, Davydov among them ^[29].

For a responder, DOJ's own limits set the scope. "The complaint does not allege that the software contained malicious code or that it was used to gain unauthorized access to any customer's computer systems or data," the department said ^[18]. No implant is alleged, so the case gives defenders nothing to sweep endpoints for. The exposure is provenance. The complaint says Oxygen US and Oxygen Russia "sold the same software, developed by the same team, and were owned by the same people" ^[16]. Russia's FSB, its Investigative Committee and its Interior Ministry bought that software under another name from a separate Davydov company, according to DOJ ^[17]. Oxygen has said its tools extract and analyze data from cloud accounts, drones and mobile devices ^[27].

The buyers' position is on record. "Procurement officials at the U.S. government customers have represented that they would not have awarded or renewed contracts for the forensic software had they known that OxygenUS was a Russian-owned company," the complaint reads ^[15]. Oxygen reportedly holds nearly 10,000 contracts in more than 150 countries ^[20]. Its website has been seized and is down ^[30].

Natalia Krapiva, senior tech legal counsel at Access Now, has pressed the issue for years. "For years, civil society warned that Oxygen Forensics was owned and built from Russia. Now the Justice Department confirmed it," she told CyberScoop ^[22]. "No surveillance tool should come anywhere near a US investigation until we know who owns it, who builds it, and who else they are selling to," Krapiva said ^[21]. Access Now wants the U.S. and the more than 100 governments it says use the technology to cut ties with the company ^[23]. Reiber's court-listed attorneys did not respond to CyberScoop, and no attorney for Davydov could be located ^[28].