CEO Arrests Jolt Federal Forensics Purchases

Scientist in protective suit using a microscope — Photo: aslysun / Shutterstock

When a digital-forensics tool used by U.S. agencies is alleged to have been secretly controlled by foreign nationals, the issue isn’t patriotism—it’s control, disclosure, and risk. In sensitive procurement, who can influence the code and the company matters as much as what the software can do.

The Short Version

Federal prosecutors allege Oxygen Forensics concealed control by five Russian nationals and misrepresented where its software was developed.
Arrests of the CEO in Idaho and a Russian national in London signal an active criminal case, not mere rumor.
Public records show the company sold digital-forensics tools to U.S. agencies for years, framing the stakes of any procurement-fraud theory.
Foreign-owned firms are not categorically barred from U.S. contracts; the crux is truthful disclosure and mitigation of foreign ownership, control, or influence (FOCI).

What the government alleges—and why it matters

According to federal prosecutors, Oxygen Forensics, a Virginia-based seller of mobile-device extraction and analysis tools, told government customers it had no foreign ownership or control and that its software was developed in the United States; prosecutors say both statements were false. The complaint-level allegations assert five Russian nationals, including Oleg Davydov, owned and controlled the company through a Cyprus holding structure, and that development occurred in Russia. The government charged the CEO, Lee Reiber, and arrested him in Idaho, while Davydov was detained at London Heathrow Airport—concrete steps that move the matter from speculation to a live criminal proceeding. These claims, if proven, go to the core of federal procurement integrity: agencies rely on vendor certifications to assess security exposure and compliance. Misstatements about beneficial ownership and software origin can invalidate eligibility for awards, trigger suspension or debarment, and, in high-sensitivity categories like digital forensics, introduce unacceptable national-security risk.

The stakes aren’t abstract. Public reporting from 2017 documented Oxygen’s sales to U.S. agencies, including Customs and Border Protection, the FBI, ICE, and the Secret Service—precisely the kinds of customers that depend on trusted tools to unlock and analyze seized devices. If prosecutors can show that beneficial ownership or development facts were hidden to obtain those sales, the case graduates from a compliance failure to an alleged fraud on the government.

How foreign ownership and control actually factor into U.S. contracting

Foreign ownership is not, by itself, a disqualifier in civilian contracting. The system is designed to manage risk, not to impose blanket bans. Agencies evaluate foreign ownership, control, or influence—FOCI—as a structured question: does a foreign party have the power, direct or indirect, to steer management or operations in ways that affect security or performance; and if so, can it be mitigated through governance, firewalls, or special security agreements? In the defense sphere, scrutiny has intensified. The Department of Defense has proposed expanding disclosure obligations for beneficial ownership and FOCI in the DFARS, aiming to make hidden influence harder and mitigation plans more rigorous. The constant in these regimes is candor: disclose who ultimately controls the entity and how the code is produced and secured. The more sensitive the category—offensive cybersecurity tools, lawful access, forensic extraction—the less tolerance there is for opacity.

That is why the Oxygen Forensics allegations are consequential. Prosecutors aren’t arguing that a Russian-founded codebase or foreign shareholders are categorically impermissible; they are arguing that the company falsely said those facts did not exist when seeking U.S. government business. If the facts are as alleged, the violation is the concealment and the procurement reliance on that concealment—not nationality per se.

What the public record supports—and what it doesn’t

Several elements appear with specificity. Prosecutors publicly described the alleged ownership-and-control scheme and named two individuals; arrests were executed in two countries on a conspiracy-to-commit-wire-fraud theory. Multiple accounts describe Oxygen’s lineage: early roots in Moscow as Oxygen Software, expansion into the United States as Oxygen Forensics, and continued Russian development under Davydov—an origin story that coheres with the government’s theory of concealment. Separately, past reporting substantiates years of U.S. agency purchasing, which supplies the procurement backdrop against which any misrepresentation would matter.

At the same time, the case in the available record remains at the complaint stage. The materials summarized here do not include the underlying complaint, affidavit, or exhibits laying out the five named owners, the Cyprus corporate record, or the specific contract certifications at issue. Nor do they include code provenance analyses that would independently anchor the development-location claim. None of that negates the Justice Department’s allegations, but it does define their procedural posture. Until an indictment, plea, or trial record fills in the details, the most one can say confidently is that the government has taken public, concrete enforcement steps consistent with a procurement-fraud theory; the adjudication lies ahead.

The company’s posture and the surrounding narrative

In the compiled sources, there is no captured, on-record corporate repudiation of the DOJ allegations. A company blog exists, but the set here contains no direct denial by Oxygen Forensics or by Reiber. Prior reporting characterized Oxygen as an American competitor founded by Russian entrepreneurs, later led by Reiber, and noted the company did not respond to comment on related intellectual-property claims in 2023. Separate Russian-language coverage cites a 2022 letter attributed to Reiber describing the U.S. entity as a reseller licensing software from a Cyprus company, not the original developer—a description that, if authentic, aligns directionally with the ownership-and-development split the DOJ now alleges, though it does not address control or disclosure to U.S. agencies. These fragments do not rebut the government’s charges; they mostly situate the firm’s corporate structure within a transnational lineage.

Mechanics of risk: why beneficial ownership and code origin matter in forensics tools

Digital-forensics suites have privileged access. They exploit vulnerabilities, parse proprietary file systems, bypass device locks, and exfiltrate data images for evidentiary use. That power creates two categories of risk. First, governance risk: who can direct product roadmaps or decide whether to prioritize a particular capability or patch? If a foreign owner can influence those choices—especially one in a jurisdiction with conflicting legal obligations—that is classic FOCI exposure. Second, supply-chain risk: where and by whom is the code authored, compiled, and signed? Development location is not a crude proxy for security, but opaque development pipelines complicate vulnerability management and incident response. Agencies make award and use decisions based in part on representations in these domains; false statements, if proven, defeat the government’s risk calculus and can poison cases that relied on the tool’s outputs.

BIG | 🇺🇸🇷🇺‼️‼️ U.S. prosecutors have uncovered an alleged scheme in which software secretly owned and developed by Russian nationals was sold to sensitive U.S. government agencies, including the Secret Service, after its Russian connections were allegedly concealed.

Oxygen… pic.twitter.com/MeilyNTSSL

— Visioner (@visionergeo) September 24, 2026

What to watch as the case moves forward

Three factual centers of gravity will decide the matter. First, the ownership chain: which individuals held which rights, through which vehicles, and what control levers—board seats, veto rights, financing covenants—did they possess? The government’s allegation of five Russian owners via a Cyprus holding company will need documentary substantiation. Second, the representations: which certifications, bids, or contract forms contained the statements the government says were false, and were agencies relying on them? Third, code provenance: where development actually occurred and what internal records—repositories, commit logs, build systems—show about authorship and control. Each question is concrete and answerable with records; each is also directly relevant to whether the theory is procurement fraud or merely uncomfortable geopolitics.

Bottom line

Foreign ownership is not a scarlet letter in federal contracting; undisclosed control and misstatements are. Prosecutors have advanced a specific, testable account of hidden beneficial ownership and offshore development tied to contracts for sensitive forensic tools, backed by arrests and a public charging document at the complaint stage. Parallel reporting confirms that the vendor did business with U.S. agencies over years, which raises the stakes of any misrepresentation. The adjudication will turn on records, not rhetoric. For agencies, the lesson is evergreen: treat beneficial ownership and development provenance as operational risk variables, verify rather than accept attestations at face value, and align awards with mitigation you can enforce—not the assurances you hope are true.