{"id":19243,"date":"2026-09-25T10:58:45","date_gmt":"2026-09-25T10:58:45","guid":{"rendered":"https:\/\/informnapalm.org\/en\/?p=19243"},"modified":"2026-09-25T11:36:21","modified_gmt":"2026-09-25T11:36:21","slug":"oxygen-forensics","status":"publish","type":"post","link":"https:\/\/informnapalm.org\/en\/oxygen-forensics\/","title":{"rendered":"\u201cOur OSINT is long-range sanctions\u201d: arrests in the US seven months after the Oxygen Forensics investigation"},"content":{"rendered":"

On September 23, 2026, the US Department of Justice<\/b> announced<\/b><\/a> the arrests of Lee Reiber, CEO of US-based Oxygen Forensics Inc., and Russian national Oleg Davydov. They are charged with participating in a conspiracy to commit fraud by allegedly concealing the company\u2019s Russian owners from US government agencies and hiding the fact that its software was developed in Russia.<\/b><\/p>\n

\"Tech<\/a><\/p>\n

The case is of particular interest to InformNapalm. On February 18, 2026, Olga Lautman, a researcher of Russian hybrid warfare and non-resident senior fellow at the Center for European Policy Analysis (CEPA), and Andrii Luchkov, a volunteer with the InformNapalm volunteer intelligence community, published a joint OSINT investigation<\/a> into the Russian origins of Oxygen Forensics technology and the use of its software by US federal agencies.<\/b><\/p>\n

\"\"<\/a><\/p>\n

Seven months later, the materials released by US investigators not only support several key findings of that investigation but also describe what prosecutors allege was a much deeper level of Russian control over the US company.<\/p>\n

What the OSINT researchers found<\/h2>\n

In their February investigation, Lautman and Luchkov examined the use of Oxygen Forensics software by US Immigration and Customs Enforcement (ICE) to extract and analyze data from smartphones.<\/p>\n

The authors traced the company\u2019s corporate and technological origins and the relationship between the US-based Oxygen Forensics and Russia\u2019s Oxygen Software, which was later renamed MKO Systems.<\/p>\n

Their analysis of open corporate records, court documents, and procurement data indicated that the Russian and US product ecosystems shared common origins. At the same time, products from the Russian side of the business were supplied to Russian security and law-enforcement agencies, including the Federal Security Service (FSB) and the Ministry of Internal Affairs.<\/p>\n

The authors also examined the broader network surrounding Russia\u2019s digital forensics industry, including individuals and entities linked to the FSB and to actors operating within the sanctions environment.<\/p>\n

Importantly, the researchers did not claim that there was a direct operational link between Russian security services and the US agencies using Oxygen Forensics products. Their point was narrower: the provenance and development chain of such sensitive software raised questions that warranted close scrutiny during government procurement.<\/p>\n

DOJ: Oxygen Forensics was allegedly controlled by five Russian nationals<\/h2>\n

According to the US Department of Justice, Oxygen Forensics presented itself to the US government as an independent American company.<\/p>\n

However, according to the criminal complaint, the company was in fact owned and controlled through a Cyprus holding structure by five Russian nationals, including Oleg Davydov.<\/p>\n

Investigators allege that the same five individuals also owned the Russian company Oxygen Software LLC, which was renamed MKO Systems LLC in September 2022.<\/p>\n

Davydov co-founded the Russian company in 2000, served as its chief technology officer, and was responsible for software development. In 2013, he also helped establish Oxygen Forensics in Virginia.<\/p>\n

The most significant allegation, however, concerns the origin of the software itself.<\/p>\n

According to the DOJ, the developers who wrote Oxygen Forensics software were based in Russia. The team operated under Davydov\u2019s supervision, while the cloud-based development environment was administered by one of the Russian owners.<\/b><\/p>\n

If established in court, this would mean that the connection between the Russian and US technology ecosystems \u2014 previously traceable through open-source research \u2014 was considerably more direct than publicly understood.<\/p>\n

FSB, Investigative Committee and Russian Interior Ministry<\/h2>\n

Another significant detail closely echoes the findings of the February investigation.<\/p>\n

According to the DOJ, Russia-based MKO Systems sold the software in Russia under different names. The criminal complaint states that its customers included:<\/p>\n