Federal prosecutors say Oxygen Forensics, based in Virginia, sold digital forensics tools to the US Department of War and several Department of Homeland Security components, including Homeland Security Investigations, the DHS Office of Inspector General, and the Secret Service's National Computer Forensics Institute (NCFI). The company presented itself as an independent US business, but was allegedly owned and controlled by five Russian nationals through a Cyprus-based holding company.
The same individuals also owned a Russian outfit formerly known as Oxygen Software LLC and now called MKO Systems LLC, which sold software under different product names to customers reportedly including the FSB, the Russian Investigative Committee, and the Russian Ministry of Internal Affairs. Prosecutors allege the software sold to US agencies was written and managed by a Russian development team under Davydov's direction.
According to the DoJ, the alleged concealment intensified after Russia invaded Ukraine in 2022 and Washington expanded sanctions. Reiber was installed as CEO, president, and chairman, while the Russian owners disappeared from public corporate filings but continued making significant decisions, including setting Reiber's compensation and retaining signatory authority over bank accounts. When a reporter inquired about Russian links in 2023, Reiber allegedly told the owners the resulting coverage "could destroy this entire opportunity" – a reference to a contract with NCFI – adding that the company's "current existence ... hangs in the balance." NCFI nevertheless awarded Oxygen a five-year software contract in September 2024.
Prosecutors also allege Oxygen told the Department of Defense that no foreign person controlled the company, and that as recently as March 2026 Reiber told DHS personnel that no Russian was involved in developing the software and that nobody in Russia had access to its build environment.
Reiber was arrested in Idaho; Davydov was detained at London's Heathrow Airport before boarding a flight to Istanbul, and the US plans to seek his extradition. Authorities have seized corporate bank accounts, around 57 domains, and other infrastructure. The DoJ is not alleging the software contained malicious code or was used to gain unauthorized access to customers' systems. Both men face up to 20 years in prison if convicted.