The federal government buys digital forensics software to recover and analyze evidence from phones, computers, and other devices. When agencies such as the Secret Service, Homeland Security, and the Department of War use those tools, finding out who owns the company and who writes the code seems like a fairly basic place to start. Federal prosecutors now say that basic question produced a spectacularly wrong answer.
From the DOJ:
The CEO of a Virginia-based software company and a Russian national have been arrested on a federal criminal complaint charging them with concealing from U.S. government agencies that their company was owned and controlled by Russian nationals and that its software was developed in Russia, the Justice Department announced today.
Lee Reiber, 55, of Boise, Idaho, was arrested in Idaho on Sunday, made his initial appearance on Tuesday in U.S. District Court in Idaho, and was ordered released on bond. He is expected to be arraigned in Los Angeles federal court in the coming weeks.
Oleg Sergeyevich Davydov, 52, of Moscow, Russia, was arrested on Sunday at London Heathrow Airport in the United Kingdom prior to boarding a flight to Istanbul. The United States expects to seek Davydov’s extradition.
The defendants are charged with conspiracy to commit wire fraud.
Oxygen Forensics CEO Lee Reiber, 55, and Russian national Oleg Davydov, 52, have been charged with conspiracy to commit wire fraud. Prosecutors allege five Russian nationals, including Davydov, actually owned and controlled the Virginia company through a Cyprus holding company. They also say the software was written and managed by a team in Russia under Davydov's direction.
There's an important limit to what prosecutors are claiming. The complaint doesn't allege malicious code, and it doesn't claim the software was used to gain unauthorized access to government computers or data. There's no need to invent a Russian backdoor when the alleged procurement failure is troubling enough on its own.
After expanded sanctions followed Russia's 2022 invasion of Ukraine, prosecutors say the Russian owners disappeared from Oxygen Forensics' public corporate filings, and Reiber became CEO, president, and board chairman. Behind the scenes, the Russian owners allegedly continued making major decisions, setting Reiber's compensation, overruling payments, and retaining signatory authority over company bank accounts.
Then comes the part federal contracting officers may want to read twice. Prosecutors say Reiber certified in 2022 and 2023 that Oxygen Forensics had no immediate or highest-level owner. When questions about the Russian connection surfaced in 2023, Reiber allegedly warned Russian owners that disclosure "could destroy this entire opportunity" involving a pending National Computer Forensics Institute contract.
The institute awarded a five-year contract for the software in September 2024. Federal award information for the Secret Service procurement vehicle containing Oxygen Forensic Detective lists a $12 million ceiling and about $1.47 million obligated.
The representations allegedly continued. Oxygen Forensics certified to the Department of War in July 2024 that no foreign person could control its directors, managers, or corporate decisions. Prosecutors say Russian owners were doing exactly that, with one even joining the board using a Turkish identity. In March 2026, Reiber allegedly told DHS personnel that no Russian was involved in developing the software. Prosecutors say the code was still being written and managed by a Russian team.
The same five Russian owners also controlled MKO Systems, prosecutors say, which sold versions of the forensic software inside Russia to customers reportedly including the FSB, the Russian Investigation Committee, and the Russian Ministry of Internal Affairs.
Federal procurement rules can't protect sensitive agencies if the answers on the forms aren't verified. If prosecutors prove these allegations, Washington didn't need a sophisticated cyberattack to create a security problem. It simply needed to trust the paperwork. Federal authorities have now seized roughly 57 domains, corporate accounts, and other infrastructure connected to the alleged scheme.
PJ Media keeps digging into the stories that deserve more than a headline. Join us and save 60% off with promo code FIGHT.
Join the Conversation
VIP members get the ability to comment on articles.