Oxygen Forensics charges allege Russian control hidden behind a U.S. CEO

Prosecutors in Los Angeles announced on 23 September that Oxygen Forensics CEO Lee Reiber and Russian co-owner Oleg Davydov each face a wire-fraud conspiracy count, per Circuit Magazine. The complaint alleges the Virginia vendor hid its Russian ownership while winning more than $2 million in contracts and purchases from the Secret Service and its National Computer Forensics Institute (NCFI), per CyberScoop. By the complaint's account, a team in Russia wrote the code under Davydov's direction, per Circuit Magazine.

Five Russian nationals allegedly controlled the company through a Cyprus holding company, per The Register. The same five owned Moscow-based Oxygen Software, now MKO Systems, which reportedly sold to the FSB, the Investigative Committee, and the Interior Ministry, per The Register and OCCRP. After Russia's 2022 invasion of Ukraine the owners disappeared from public filings but allegedly kept signatory authority over the company's bank accounts, per The Register. Davydov allegedly moved the build to U.S. cloud computers so development could pass as U.S.-based, per Zero Day.

1. Dec 2022Alleged false ownership certification; another follows in October 2023, per Circuit Magazine.
2. Feb–Mar 2026Reiber allegedly assures NCFI of U.S. ownership and DHS of no Russian development, per CyberScoop and The Register.
3. 20 Sep 2026Reiber is arrested in Idaho and released on bond; Davydov is detained at Heathrow, per OCCRP.

By the complaint's account, self-certification and direct questions did not surface the Russian control. In November 2023, after a reporter's inquiry, Reiber allegedly warned the owners that coverage “could destroy this entire opportunity”, per Circuit Magazine. DOJ says the complaint does not allege malicious code or unauthorized access, per OCCRP. The software extracts data from mobile phones, computers, and other devices, per Zero Day. The alleged exposure is hidden foreign control of that tool, not a backdoor. A certificate-only check misses the holding company, the bank signatories, and the build environment.

• Map beneficial ownership of every investigative tool, down to bank signatories.
• Ask where the code is written and who can reach the build environment.
• Re-vet on a leadership change, press inquiry, or sanctions event, not only at award.
• Log each check; a human reviewer decides every flag.

OBSIDIAN — Counterintelligence is designed to support the ownership side of this work: beneficial-ownership and hidden-structure mapping, sanctions and adverse-media screening, and FOCI-indicator detection for suppliers, investigative-tool vendors included, with audit-ready reports that call out red flags. Bank signatories and build environments stay questions the buyer puts to the vendor; vetting staff and counsel make the trust decision.

In July we covered a proposed DFARS rule to extend foreign-ownership vetting to unclassified contracts. Per CyberScoop, the Secret Service and NCFI purchases began in March 2022, more than four years before the charges; by the complaint's account, they continued through two ownership certifications and direct assurances. Treat certification as where vetting starts.