Federal prosecutors say a Virginia digital forensics company sold software to U.S. government customers while concealing that Russian nationals owned and controlled the firm and that the code was written in Russia. The Justice Department announced the arrests on Wednesday, September 23, 2026. The case remains at the complaint stage. Neither defendant has been convicted, and both are presumed innocent.

Lee Reiber, 55, of Boise, Idaho, the chief executive of Oxygen Forensics Inc., and Oleg Sergeyevich Davydov, 52, of Moscow, a Russian national prosecutors describe as a co-owner and the person responsible for software development, were arrested on Sunday, September 20. Reiber was taken into custody in Idaho, appeared Tuesday in U.S. District Court there, and was released on bond. He is expected to be arraigned in Los Angeles federal court.

Davydov was arrested at London Heathrow Airport before a flight to Istanbul. The United States intends to seek his extradition. Both men are charged with conspiracy to commit wire fraud. If convicted, each faces a statutory maximum of 20 years in federal prison.

A criminal complaint contains only allegations. The company and the product Oxygen Forensics Inc. is based in Alexandria, Virginia. It markets digital forensic software used to recover, preserve, and analyze data from phones and other devices without altering the original files. The product sold to government customers is widely known as Oxygen Forensic Detective.

According to an affidavit filed with the complaint, prosecutors say the company held itself out as an independent, U.S.-based firm. In fact, they allege, Davydov and four other Russian nationals owned and controlled it through a holding company in Cyprus. The same five people also owned a Russian company co-founded by Davydov in 2000. That firm was known as Oxygen Software LLC until September 2022 and later as MKO Systems LLC.

Davydov served as its chief technology officer and oversaw development, prosecutors say. He helped establish the Virginia company in 2013. Reiber joined in August 2015. The affidavit states that developers who wrote the software worked in Russia.

MKO sold related software in Russia under different product names to customers that reportedly included the Russian Federal Security Service, the Russian Investigative Committee, and the Russian Ministry of Internal Affairs. What prosecutors say was concealed Prosecutors allege the concealment began after the United States expanded sanctions on Russia in early 2022 following the invasion of Ukraine. They say Davydov, Reiber, and Russian co-conspirators agreed to hide Oxygen Forensics’ true ownership and the fact that its software was developed in Russia.

In March 2022, Reiber was installed as chief executive, president, and chairman of the board. The Russian owners were then removed from public corporate filings, the affidavit says. Prosecutors allege those owners continued to make significant decisions, set Reiber’s compensation, overrule him on payments, and hold signatory authority over company bank accounts. The complaint accuses Reiber of representing to the government that the company had no foreign ownership or control and that its software was developed in the United States.

In December 2022 and October 2023, he allegedly certified that Oxygen Forensics had no immediate or highest-level owner. In July 2024, at Reiber’s direction, the company certified to the Department of War that no foreign person had the power to appoint directors or managers or to direct the company’s decisions. Prosecutors say Reiber knew that was false, and that one Russian owner had recently been appointed to the board under a Turkish identity. They also allege a technical disguise.

In March 2022, Reiber and Davydov arranged for Reiber to start software builds on U.S. cloud infrastructure so he could say, in his own words quoted in the affidavit, “this is what I do or what we do in the US,” while the code continued to be written, reviewed, and managed by a team in Russia. The complaint says the software was written and managed under Davydov’s direction in a cloud environment administered by one of the Russian owners.

In March 2026, Reiber told Department of Homeland Security personnel that no Russian was involved in developing the software and that no one in Russia had access to the build environment, the affidavit says. Days later he authored a company website statement declaring that Oxygen Forensics had no development presence in any restricted jurisdiction.

A Commerce Department special agent wrote in the complaint that Reiber knew as early as 2018 that the U.S. government had security concerns about Russian-developed software, and that he was told in writing in January 2024 that foreign government customers would not buy the product if its development in Russia were disclosed.

In November 2023, after a reporter asked Reiber about ownership and the Russian company, he wrote Davydov and two other Russian owners that public reporting “could destroy this entire opportunity,” referring to a pending National Computer Forensics Institute contract, and that the “current existence of this company hangs in the balance.” Which agencies bought or used the software The affidavit identifies customers as the Department of War and three Homeland Security components: the U.S.

Secret Service and its National Computer Forensics Institute, Homeland Security Investigations, and the DHS Office of Inspector General. In September 2024, the National Computer Forensics Institute awarded a five-year contract for the software. Reporting based on the Justice Department materials puts that contract’s ceiling at $12 million. The award file included Reiber’s October 2023 certification that the company had no immediate or highest-level owner.

Separate public contracting summaries cited in industry reporting put cumulative federal spending on the Oxygen Forensic Detective platform at least at $5.6 million since 2011, with Homeland Security accounting for about $2.7 million and additional purchases by Treasury and Justice. Public award records also show other federal offices have bought licenses. Those spending figures come from contract databases, not from a completed trial record.

What authorities say about risk to government systems The Justice Department stated plainly that the complaint does not allege the software contained malicious code or that it was used to gain unauthorized access to any customer’s computer systems or data. That distinction matters. The charged conduct is alleged fraud in how the company obtained government business, not a completed cyber intrusion.

The national-security concern described by investigators is different: a widely used forensic tool that extracts data from seized devices was, prosecutors say, owned by Russian nationals, written in Russia, and sold to U.S. agencies after false ownership and origin statements. Digital forensic software sits close to sensitive investigations. Agencies use it to pull messages, files, and other evidence from phones. If foreign ownership and development are hidden, officials cannot fully weigh supply-chain risk, update control, or who can see how the product is built.

Some forensic examiners have said the company’s Russian origins were known in parts of the profession. The complaint focuses on what was told to government buyers after 2022 sanctions, not on whether every examiner was unaware. How the investigation unfolded The Bureau of Industry and Security is investigating, with help from the Department of War Office of Inspector General’s Defense Criminal Investigative Service Cyber Field Office. The Justice Department’s Office of International Affairs is assisting with Davydov’s provisional arrest and expected extradition.

Assistant U.S. Attorneys David C. Lachman of the Major Frauds Section and Joshua O. Mausner of the National Security Division are prosecuting.

Assistant U.S. Attorney James E. Dochterman is handling forfeitures. Industry reporting says investigators had been examining Oxygen Forensics since at least May 2025.

The affidavit draws on certifications, corporate filings, internal messages, and statements to government personnel. On September 19, a federal magistrate in the Central District of California authorized seizure of corporate bank accounts, about 57 domains, and other cyberinfrastructure. Those domains and related systems were seized on September 20, the same day as the arrests. Statements and the company’s posture The Justice Department emphasized that a complaint is not a finding of guilt.

An attorney for Reiber did not immediately respond to a request for comment after the announcement. No public statement from Davydov or a defense lawyer for him was available in official materials released with the arrests. Oxygen Forensics had previously published statements presenting itself as a U.S. company without development in restricted jurisdictions. Before the arrests, the company also sued a former employee, alleging that person told customers the firm was owned or controlled by the Russian Federal Security Service.

Those claims have not been adjudicated in this criminal case and are separate from the prosecutors’ allegations. Why the case matters After 2022, U.S. agencies tightened scrutiny of Russian ownership, control, and software development in federal supply chains. Forensic tools are not ordinary office software. They touch evidence in criminal, border, and protective investigations.

False statements about who owns a vendor and where code is written undercut the government’s ability to apply those rules. Prosecutors have not charged espionage, sanctions violations as a standalone count, or computer intrusion. They have charged a conspiracy to obtain federal contracts through alleged deceit about ownership and origin. The difference is important.

The government is alleging procurement fraud with national-security implications, not that it has proven a backdoor in the product. Reiber is out on bond pending proceedings in Los Angeles. Davydov remains in British custody subject to extradition. Corporate accounts and dozens of domains have already been seized.

The next court steps, and any defense response, will determine how much of the affidavit survives as proven fact.