Russian-Owned Forensics Vendor Allegedly Posed as American to Supply Pentagon, Secret Service

US prosecutors say five Russian nationals secretly controlled a Virginia software firm whose phone-cracking tools sit inside federal law enforcement and defence networks.

Intelligence Lead

A criminal complaint unsealed in the Central District of California alleges that Oxygen Forensics, a US-registered supplier of mobile-device extraction software, was secretly owned and developed by Russian nationals while holding contracts with the Department of War, the Secret Service and Homeland Security components. The case, if proven, describes a counterintelligence exposure inside the federal digital-forensics supply chain rather than a conventional fraud. The complaint does not allege the software contained malicious code.

Situation Report

Lee Reiber, 55, the company's chief executive, and Oleg Davydov, 52, a Russian national and co-founder, are charged with conspiracy to commit wire fraud against federal agencies, according to the US Attorney's Office for the Central District of California. Reiber was arrested in Idaho on 20 September and released on bond. Davydov was detained at London Heathrow before a flight to Istanbul; the United States is seeking his extradition. Each faces up to 20 years in prison.

The complaint alleges that Davydov and four other Russian nationals controlled Oxygen Forensics Inc. through a Cyprus-based holding company, with Reiber installed as CEO in March 2022. Prosecutors allege false ownership certifications were submitted in December 2022 and October 2023, that the National Computer Forensics Institute, a Secret Service training centre, awarded a five-year software contract in September 2024, and that false statements about Russian development involvement were made as recently as March 2026.

Agencies identified as affected include the Department of War, the Secret Service, Homeland Security Investigations and the DHS Office of Inspector General. On 20 September, authorities seized corporate bank accounts, roughly 57 internet domains and related cyber infrastructure. The Bureau of Industry and Security led the investigation with support from the Department of War Office of Inspector General.

Background & Context

Oxygen Forensics markets software that extracts and analyses data from phones and computers, including by circumventing device security features. Davydov co-founded the Russian parent, Oxygen Software LLC, in 2000; it was later renamed MKO Systems LLC after Western sanctions followed Russia's 2022 invasion of Ukraine. Reporting by Radio Free Europe/Radio Liberty indicates the product was marketed in Russia as Mobile Forensic Detective and saw wide use among Russian law enforcement. According to the intelNews summary of the complaint, a predecessor firm sold similar technology to the FSB and other Russian agencies.

The case fits a pattern in which Western governments discover foreign-controlled vendors after the fact. Forensic extraction tools are uniquely sensitive: they touch seized devices, evidence and investigative methods. Ownership disclosure rules exist precisely because such tools cannot be treated as ordinary commercial software.

Analysis & Assessment

It is assessed with high confidence that the central allegation, concealed Russian control, is a serious procurement-integrity failure regardless of how the criminal case ends. Whether the concealment served an intelligence purpose is a separate question that the public record does not answer. The absence of alleged malicious code is significant but not exculpatory: extraction software can leak data through telemetry, update channels, licensing servers or developer access without containing overtly malicious functions.

Two alternative explanations carry weight. The first is commercial: Russian founders may have hidden ownership to preserve US market access after sanctions, with no tasking from Moscow. The second is deliberate access-seeking by actors with historical ties to FSB customers. Available reporting is consistent with both. The seizure of 57 domains suggests investigators consider the infrastructure itself, not only the paperwork, to be a matter of concern. Expect an audit of deployed installations, and expect pressure on agencies to demand software bills of materials and beneficial-ownership attestations from forensic vendors.