Coverage from The Record, CyberScoop, and ALXnow (Sep 24), attributing a DOJ announcement and criminal complaint: Reiber was arrested Sunday in Idaho and released on bond; Davydov was arrested the same day at London Heathrow. Both face up to 20 years if convicted. U.S. authorities plan to seek Davydov’s extradition. A federal magistrate in the Central District of California ordered seizure of corporate bank accounts, about 57 domains, and related cyber infrastructure (DOJ via those reports). Oxygen’s public website is down.
Buyers named in the reporting: Department of Defense, DHS components including the U.S. Secret Service, National Computer Forensics Institute (NCFI), Homeland Security Investigations, and the DHS Office of Inspector General. CyberScoop, citing the complaint: after 2022 sanctions, Oxygen won more than $2 million in contracts and purchases from the Secret Service and NCFI. NCFI signed a five-year deal in September 2024 after ownership certifications that prosecutors say were false. Exact total federal spend across all agencies: treat broader totals as Undisclosed unless a DOJ primary reprints them.
Alleged mechanics (complaint color via secondaries): after Russia’s 2022 Ukraine invasion and expanded U.S. sanctions, Russian owners were removed from public corporate filings and Reiber was installed as CEO / president / chairman (March 2022) while Russians allegedly kept decision and bank-signatory control. The same five individuals allegedly owned a Russian company (formerly Oxygen Software LLC; later MKO Systems LLC) that sold related software in Russia to customers that reportedly included the FSB, the Russian Investigative Committee, and the Ministry of Internal Affairs. Reiber allegedly certified no foreign control to DOD and told DHS in 2026 that no Russians were involved in making the software.
Critical accuracy gate: DOJ (per every major writeup) is not alleging the forensics product contained malware or was used to exfiltrate U.S. customer data. The charge is procurement fraud — lying about ownership and development location to win and keep federal contracts that officials say they would not have awarded had they known. Oxygen is a direct competitor in the mobile/digital forensics extraction category often compared to Cellebrite. Global contract count / revenue: The Record’s “nearly 10,000 contracts / 150+ countries” is reported color, not audited CyberMerge fact without a primary filing.
POV: this is a supply-chain trust story for every agency and MSP that buys phone-extraction tooling — ownership attestations and sanctions screening are the underwrite, not a CVE. Watch for the DOJ primary press release URL, any DOJ website mirror of the complaint, and whether other Western LE buyers pause Oxygen / MKO deployments. Until a justice.gov primary is in hand, The Record / CyberScoop / ALXnow are the sourced secondaries, and unprinted dollar totals stay Undisclosed.