The CEO of a digital forensics company has been arrested and charged over allegations of concealing the company’s ties with Russia from the U.S. government agencies that bought its software.
The US Department of Justice alleges that Lee Reiber, 55, of Boise, Idaho, and Moscow resident Oleg Sergeyevich Davydov, 52, conspired to hide the company’s Russian ownership and Russian-built code in order to win federal contracts. Both face charges of conspiracy to commit wire fraud.
According to the DOJ, Reiber was the American face of Oxygen Forensics Inc., an Alexandria, Virginia-based company whose software recovers, preserves, and analyzes data from digital devices while leaving the original files unchanged.
The company held itself out to the U.S. government as an independent, U.S.-based firm with no foreign ownership, whose software was developed in the United States.
According to the affidavit, the affected customers were the Department of War and three DHS components: the Secret Service and its National Computer Forensics Institute (NCFI), Homeland Security Investigations, and the DHS Office of Inspector General.
The reality, according to prosecutors, was that five Russian nationals, including Davydov, owned and controlled the company through a holding company in Cyprus, and the people who were actually writing the code for the forensics tool were in Russia.
Those same five owners also controlled a Russian company, known as Oxygen Software LLC until September 2022 and now as MKO Systems LLC, which Davydov co-founded in 2000, the DOJ said. MKO sold the software in Russia under different product names to customers that reportedly included the Russian Federal Security Service (FSB), the Russian Investigative Committee, and the Russian Ministry of Internal Affairs.
Davydov was the Russian company’s CTO and helped set up Oxygen Forensics in Virginia in 2013. Reiber joined in August 2015.
To clarify, the complaint does not allege that the software contained malicious code or was used to gain unauthorized access to any customer’s systems or data. Still, the allegations raises questions about those agencies that trusted the tool to handle evidence and personal data regarding who actually built it?
The answer was hardly a secret. In her own coverage of the arrests, veteran security journalist Kim Zetter noted that Oxygen’s Russian ownership had long been known in the forensics industry. A decade earlier, she described the company in The Intercept as “a Russian firm” whose website listed the IRS, the U.S. Army, the Defense Department, DHS and the Justice Department among its customers.
Neither is the case framed as espionage. Instead, the DOJ says the alleged cover-up began after the U.S. expanded sanctions on Russia in early 2022 over its invasion of Ukraine. That’s when the defendants “agreed to conceal Oxygen Forensics’ true ownership and the development of its software in Russia”. Reiber was installed as CEO, president, and board chairman in March 2022, and the Russian owners were removed from the company’s public corporate filings.
Prosecutors say the Russian owners still made significant decisions. They set Reiber’s compensation, overruled him on payments, and held signatory authority over the company’s bank accounts.
Reiber falsely certified to the government in December 2022 and October 2023 that Oxygen Forensics had no immediate or highest-level owner, prosecutors allege. In September 2024, the NCFI awarded the company a five-year contract, and the October 2023 certification was part of the award file. In July 2024, at Reiber’s direction, the company told the Department of War that no foreign person controlled it. By then, one of the Russian owners had recently been appointed to its board under a Turkish identity.
In November 2023, a reporter asked Reiber about the company’s Russian connection. Reiber then wrote to Davydov and two other owners that public reporting “could destroy this entire opportunity,” according to the affidavit, referring to the pending NCFI contract.
As late as March 2026, Reiber told DHS personnel that no Russian was involved in developing the software. Days later, he wrote a statement for the company’s website saying it had no development presence in any restricted jurisdiction. According to the complaint, the code was managed in a cloud environment run by one of the Russian owners.
Separately, a federal magistrate judge authorized the seizure of corporate bank accounts, about 57 domains, and other infrastructure, which were taken down on Sept. 20.
Reiber was arrested in Idaho on Sept. 20 and released on bond after an initial appearance in federal court. He is expected to be arraigned in Los Angeles in the coming weeks. Davydov was arrested the same day at London’s Heathrow Airport before boarding a flight to Istanbul, and the U.S. expects to seek his extradition.
Each defendant faces up to 20 years in federal prison. The Commerce Department’s Bureau of Industry and Security is leading the investigation, with help from the Defense Criminal Investigative Service’s Cyber Field Office.
A criminal complaint contains only allegations, and both men are presumed innocent until proven guilty.
Photo by Antoni Shkraba via Pexels
