On September 23, 2026, the US Department of Justice announced the arrests of Lee Reiber, CEO of US-based Oxygen Forensics Inc., and Russian national Oleg Davydov. They are charged with participating in a conspiracy to commit fraud by allegedly concealing the company’s Russian owners from US government agencies and hiding the fact that its software was developed in Russia.
The case is of particular interest to InformNapalm. On February 18, 2026, Olga Lautman, a researcher of Russian hybrid warfare and non-resident senior fellow at the Center for European Policy Analysis (CEPA), and Andrii Luchkov, a volunteer with the InformNapalm volunteer intelligence community, published a joint OSINT investigation into the Russian origins of Oxygen Forensics technology and the use of its software by US federal agencies.
Seven months later, the materials released by US investigators not only support several key findings of that investigation but also describe what prosecutors allege was a much deeper level of Russian control over the US company.
What the OSINT researchers found
In their February investigation, Lautman and Luchkov examined the use of Oxygen Forensics software by US Immigration and Customs Enforcement (ICE) to extract and analyze data from smartphones.
The authors traced the company’s corporate and technological origins and the relationship between the US-based Oxygen Forensics and Russia’s Oxygen Software, which was later renamed MKO Systems.
Their analysis of open corporate records, court documents, and procurement data indicated that the Russian and US product ecosystems shared common origins. At the same time, products from the Russian side of the business were supplied to Russian security and law-enforcement agencies, including the Federal Security Service (FSB) and the Ministry of Internal Affairs.
The authors also examined the broader network surrounding Russia’s digital forensics industry, including individuals and entities linked to the FSB and to actors operating within the sanctions environment.
Importantly, the researchers did not claim that there was a direct operational link between Russian security services and the US agencies using Oxygen Forensics products. Their point was narrower: the provenance and development chain of such sensitive software raised questions that warranted close scrutiny during government procurement.
DOJ: Oxygen Forensics was allegedly controlled by five Russian nationals
According to the US Department of Justice, Oxygen Forensics presented itself to the US government as an independent American company.
However, according to the criminal complaint, the company was in fact owned and controlled through a Cyprus holding structure by five Russian nationals, including Oleg Davydov.
Investigators allege that the same five individuals also owned the Russian company Oxygen Software LLC, which was renamed MKO Systems LLC in September 2022.
Davydov co-founded the Russian company in 2000, served as its chief technology officer, and was responsible for software development. In 2013, he also helped establish Oxygen Forensics in Virginia.
The most significant allegation, however, concerns the origin of the software itself.
According to the DOJ, the developers who wrote Oxygen Forensics software were based in Russia. The team operated under Davydov’s supervision, while the cloud-based development environment was administered by one of the Russian owners.
If established in court, this would mean that the connection between the Russian and US technology ecosystems — previously traceable through open-source research — was considerably more direct than publicly understood.
FSB, Investigative Committee and Russian Interior Ministry
Another significant detail closely echoes the findings of the February investigation.
According to the DOJ, Russia-based MKO Systems sold the software in Russia under different names. The criminal complaint states that its customers included:
- the Federal Security Service of the Russian Federation (FSB);
- the Investigative Committee of the Russian Federation;
- the Russian Ministry of Internal Affairs.
At the same time, Oxygen Forensics received contracts from US government agencies. According to the criminal complaint, agencies identified as victims included a US defense agency and several Department of Homeland Security bodies, among them the US Secret Service and its National Computer Forensics Institute, Homeland Security Investigations, and the DHS Office of Inspector General.
Lautman and Luchkov flagged the use of Oxygen products by US federal law-enforcement agencies as a central issue in their February OSINT investigation.
The public USAspending federal spending database also contains a record for procurement No. 70CMSD24P00000157. The contracting department is listed as the Department of Homeland Security (DHS) and the recipient as Oxygen Forensics Inc. Federal obligations under the contract total $126,914. The contract began on September 30, 2024; its current end date is September 29, 2026, with a potential end date of September 29, 2027.
Department of Homeland Security contract record for Oxygen Forensics Inc. worth $126,914. Purchase Order No. 70CMSD24P00000157. Source: USAspending.gov.
A detailed breakdown of the same procurement identifies the specific contracting agency as US Immigration and Customs Enforcement (ICE), part of the Department of Homeland Security. Oxygen Forensics is listed as the recipient, with the contract performance period beginning on September 30, 2024.
Russian ownership was allegedly concealed after 2022
According to US investigators, after sanctions against Russia expanded in 2022, Davydov, Reiber, and other alleged co-conspirators agreed to conceal Oxygen Forensics’ true ownership structure and the Russian origin of its software development.
In March 2022, Reiber became CEO, president, and chairman of the board, while the Russian owners disappeared from publicly available corporate records.
However, the DOJ alleges that their effective control remained in place.
According to investigators, the Russian owners continued to make important decisions, set Reiber’s compensation, could override his decisions concerning payments, and retained signatory authority over company bank accounts.
The complaint alleges that in December 2022 and October 2023, Reiber falsely certified to the US government that Oxygen Forensics had no direct or ultimate beneficial owner.
The DOJ cites another notable episode. In November 2023, a journalist contacted Reiber with questions about Oxygen Forensics’ ownership and its ties to the Russian company. Reiber then wrote to Davydov and two other Russian owners that public exposure of the relationship “could destroy this entire opportunity” — referring to the prospect of securing a contract with the National Computer Forensics Institute.
Despite this, in September 2024 the NCFI awarded a five-year software contract.
Questions over Russian development resurfaced after the OSINT publication
The subsequent timeline is also noteworthy.
On February 18, 2026, Lautman and Luchkov published their OSINT investigation raising questions about the technology’s Russian origins and its use by US federal agencies.
According to the DOJ, in March 2026 Reiber told DHS employees that no Russian nationals were involved in developing the software and that no one in Russia had access to the environment in which it was developed.
Several days later, Reiber published a statement on the Oxygen Forensics website saying that the company had no developers in jurisdictions subject to the relevant restrictions.
Federal investigators now allege that those representations were false and that the software was developed and administered by a Russia-based team under Davydov’s supervision.
Arrests and seizure of infrastructure
Lee Reiber was arrested in Idaho on September 20, 2026. Following his initial court appearance, he was released on bond.
Oleg Davydov was detained the same day at London Heathrow Airport before boarding a flight to Istanbul. The United States intends to seek his extradition.
Both men are charged with conspiracy to commit wire fraud. If convicted, each faces a statutory maximum sentence of up to 20 years in federal prison.
Separately, a federal court authorized the seizure of corporate bank accounts, approximately 57 domain names, and other cyber infrastructure that investigators allege was used as part of the scheme described in the complaint.
When OSINT gets there before a criminal case becomes public
The Oxygen Forensics case is another example of the practical value of journalistic OSINT.
Open corporate registries, public procurement records, court filings, technical documentation, and other publicly available sources can allow journalists and independent researchers to identify connections and risks long before law-enforcement agencies are able to make details of their criminal investigations public.
That is why open-source investigations matter not only as journalism. They create a verifiable public record that journalists, government agencies, sanctions authorities, and law-enforcement bodies can later consult and scrutinize.
Andrii Luchkov summed up the story wryly in an InformNapalm volunteer work chat:
“Our OSINT is our long-range sanctions. In response to Russia’s unprovoked aggression and war.”
