Counterintelligence — 2026-09-24

DOJ Arrests CEO of Digital Forensics Firm Oxygen Forensics for Concealing Russian Ownership from Federal Customers

BLUFFederal agencies that relied on Oxygen Forensics' false ownership certifications will likely suspend or debar the firm from government contracting by late January 2027, forcing a scramble to replace embedded digital forensics tools.

The Justice Department announced on Wednesday the arrest of Oxygen Forensics CEO Lee Reiber, 55, in Idaho and CTO Oleg Sergeyevich Davydov, 52, at London Heathrow Airport, both charged with conspiracy to commit wire fraud 12. Prosecutors allege that from March 2022 the two, along with three other Russian nationals who owned and controlled the Virginia-based firm through a Cyprus holding company, concealed that ownership and the Russian development of its forensic software from federal customers including the Department of War, Secret Service, Homeland Security Investigations, and DHS's Office of Inspector General 1. The complaint states that in December 2022 and October 2023 Reiber falsely certified to the government that the company had no foreign owner, and in July 2024 certified to the Department of War that no foreign person controlled its decisions; certifications on which the Secret Service's National Computer Forensics Institute relied in awarding a five-year, $12 million contract in September 2024 12. A federal magistrate judge in the Central District of California issued a warrant on September 19 to seize corporate bank accounts and roughly 57 domains, executed the following day 1. Prosecutors state the complaint does not allege the software contained malicious code or was used for unauthorized access to customer systems 13.

Analysis
Formal suspension or debarment of Oxygen Forensics from federal contracting is likely by January 31, 2027. The September 19 warrant seizing corporate accounts and roughly 57 domains, executed within a day of the arrests, signals coordinated agency action to sever the firm ahead of trial, and the NCFI's $12 million contract gives procuring agencies an administrative trigger independent of the criminal case's timeline. This is assessed with high confidence given the complaint's specific certification dates and the seizure's rapid execution. Sourcing converges directly on the DOJ complaint and independent reporting, with other outlets corroborating rather than adding independent lines. The case may instead reflect certification fraud confined to two executives rather than supply-chain compromise, since prosecutors found no malicious code and the firm's Russian origins were reportedly known within the industry. This distinction will shape whether DHS, Secret Service, and Department of War officials keep relying on Oxygen's software pending trial or force costly requalification of state and local labs trained on the NCFI platform.

4 sources

Tech CEO, Russian National Arrested on Complaint Alleging They Hid Russian Ownership and Development of Software Sold to U.S. Government - U.S. Department of Justice (USAO-CDCA)
Feds accuse Secret Service software provider of hiding Russian ties - Courthouse News Service
US-Based Digital Forensics Firm Hid its Russian Ownership from U.S. Government Customers - Zero Day
Phone Hacking Software Firm Hid Russian Ownership, Say Feds - GovInfoSecurity