Oxygen Forensics execs charged over hidden Russian ties

The US Department of Justice (DOJ) has arrested two senior figures at Oxygen Forensics, a digital forensics and data extraction company whose software was bought by several federal agencies. Prosecutors allege the firm hid that Russian nationals controlled it and that its technology was developed in Russia.

Oxygen sells tools that investigators use to extract and analyze data from mobile devices, cloud services and drones. It competes directly with Cellebrite. Police and intelligence agencies commonly use this kind of software to break into phones. The company reportedly holds close to 10,000 contracts across more than 150 countries.

Its customers included the Department of Defense (DOD) and the Department of Homeland Security (DHS). Within DHS, several branches used Oxygen products:

• the Secret Service
• Homeland Security Investigations
• the Office of the Inspector General
• the National Computer Forensics Institute (NCFI), a federal center that trains law enforcement in digital evidence

Two arrests, 57 domains seized

CEO Lee Reiber, 55, of Boise, Idaho, was arrested on Sunday and released on bond. On the same day, chief technology officer Oleg Sergeyevich Davydov, 52, a Moscow resident, was detained in London. US authorities plan to seek his extradition.

Both men are charged with conspiracy to commit wire fraud, which carries up to 20 years in prison. On September 20, authorities seized about 57 domains, along with cyber infrastructure and corporate bank accounts belonging to the firm. Oxygen's website is now offline.

A DOJ affidavit describes what Reiber allegedly told agencies considering contracts. He said the software was developed in the US, "when in fact five Russian nationals, including Davydov, owned and controlled the company and its software was developed in Russia."

Oxygen is formally headquartered in Virginia. Prosecutors say Davydov and four other Russians hid their ownership behind a holding company in Cyprus. A separate Davydov company allegedly sold the same software under a different name to Russia's Federal Security Service (FSB), the Russian Investigative Committee and the Russian Ministry of Internal Affairs.

The DOJ said it is not alleging that the software was used to gain unauthorized access to customers' data or systems. It also found no evidence that the software contained malicious code.

Sanctions prompted the cover-up

Prosecutors say the scheme started after Russia invaded Ukraine and the US imposed new sanctions. The company then removed the Russian owners' names from its corporate filings. Reiber became CEO, president and chairman of the board in March 2022, shortly before those filings were changed.

According to the DOJ, the Russian owners kept making significant decisions after his appointment. They set Reiber's compensation, overruled him on payments and held signatory authority over the company's bank accounts.

In November 2023, a journalist asked Reiber about the Russian connections. Prosecutors say he then wrote to Davydov that media attention "could destroy this entire opportunity." They allege this referred to a pending NCFI contract.

The NCFI signed a five-year deal with Oxygen in September 2024. The filing noted that Reiber had certified the company had no "immediate or higher level owner." Almost a year later, Oxygen allegedly certified to the DOD that "no foreign person had the power to control the appointment of the company's directors or managers or to direct its other decisions or activities." In 2026, Reiber allegedly told DHS officials that no Russians were involved in making the software.

Rights groups say the ties were no secret

Digital rights advocates have tracked Oxygen for years. They say its Russian links were an open secret.

"No surveillance tool should come anywhere near a US investigation until we know who owns it, who builds it, and who else they are selling to," said Natalia Krapiva, senior tech legal counsel at Access Now.

"The same software sold to US law enforcement was used by the FSB to pull data off the phones of anti-war Russians and turn it into criminal charges," she added.

Our Take

This is a fraud case, not an espionage case. The DOJ says it found no malicious code and no unauthorized access. Even so, the allegations point to a weakness in procurement. Agencies appear to have relied largely on the vendor's own certifications about ownership, including for tools that handle some of the most sensitive evidence investigators collect.

Forensic software needs deep access to seized devices. That suggests ownership and development location should matter even when no backdoor is found. The case fits into a broader debate about software supply chains and foreign control of vendors.

Several things are worth watching. One is whether Davydov is extradited from the UK. Another is whether agencies start checking the ownership of other forensic vendors more closely. It also remains to be seen how cases built on evidence extracted with Oxygen tools will be handled.