The forensics supply chain just became a procurement-integrity story. Not a malware claim. Alleged concealment of Russian ownership while selling to U.S. law enforcement and Defence buyers. Underwrite the complaint as allegations. Defendants are presumed innocent.
Per CyberScoop (Tim Starks, September 24, 2026) and CNBC (September 25, 2026), the Justice Department charged Lee Reiber — CEO of Oxygen Forensics (Oxygen US), arrested in Boise, Idaho — and Russian national Oleg Davydov — arrested at London Heathrow en route to Istanbul, extradition sought — with conspiracy to commit wire fraud. CNBC: Reiber is 55, released on bond, arraignment in Los Angeles expected in coming weeks; Davydov is 52, of Moscow; the charge carries a maximum of 20 years. No justice.gov primary was located; facts below are attributed to these secondaries summarizing the complaint and DOJ statement.
What prosecutors allege (complaint framing via reporting). Oxygen publicly presented as U.S.-owned and Alexandria, Va.–based while, the complaint alleges, Russian officials with the company repeatedly overruled Reiber. After 2022 Russia sanctions expanded, Reiber was installed as CEO (March 2022 per CNBC) and owners were removed from public filings. Davydov and four other Russian nationals allegedly owned the firm via a Cyprus holding; software was written by a Russia-based team Davydov directed, CNBC reports. CyberScoop: since March 2022 Oxygen sold to the Secret Service, HSI, DHS IG, and DOD; after 2022 sanctions, more than $2 million in contracts/purchases from the Secret Service and its National Computer Forensics Institute (NCFI); Reiber asserted U.S. ownership to NCFI as recently as February of this year.
Certifications and the $12M line. CNBC, citing the complaint: Reiber signed government paperwork in December 2022 and October 2023 falsely stating the company was independent with no external owner; that certification helped secure a five-year, $12 million contract with a Secret Service training unit in 2024. As recently as March, prosecutors say he denied Russian ownership on a recorded undercover DHS call. Investigators seized corporate bank accounts and roughly 57 web domains under a September 19 warrant.
Context the complaint itself flags. CyberScoop notes a 2023 Elcomsoft reverse-engineering dispute context, and that Oxygen Russia customers included the FSB. Procurement officials, per the complaint as quoted, represented they would not have awarded or renewed contracts had they known Oxygen US was Russian-owned. Critically — DOJ’s announcement, as reported by CyberScoop: the complaint does not allege malicious code or unauthorized access to customer systems or data. Access Now’s Natalia Krapiva called the move overdue and urged governments using the tech to sever ties and investigate — civil-society commentary, not a court finding.
Weissberg / BIS. CNBC: allegations track claims Max Weissberg made in a February YouTube video; Oxygen sued Weissberg for defamation in August in Virginia federal court. BIS is investigating with Department of War Office assistance; defendants presumed innocent unless proven guilty.
POV. Vendor trust and foreign-ownership due diligence for LE / Defence tooling just moved from checkbox to board risk. Absence of malware allegations ≠ procurement integrity. Boards and contracting officers should ask how many other dual-use forensic vendors have the same ownership-disclosure gap — and whether certifications of “independent / no external owner” are independently verified. Victim counts beyond the sourced contract figures above: Undisclosed. Allegations remain allegations.
Underwrite sheet — sourced only: CyberScoop Sep 24, 2026 (Starks) — Reiber (Boise) + Davydov (London, extradition sought) arrested; conspiracy to commit wire fraud; alleged US-owned presentation while Russian control; post-2022 sanctions CEO install / owners off filings; sales to Secret Service, HSI, DHS IG, DOD; >$2M Secret Service/NCFI post-sanctions; Feb NCFI US-ownership assertion; Oxygen Russia customers included FSB; 2023 Elcomsoft context; procurement would not have awarded/renewed if known Russian-owned (complaint); DOJ: no malicious code / unauthorized access alleged; Access Now Krapiva quotes. CNBC Sep 25 — Reiber 55 bond / LA arraignment; Davydov 52 Heathrow→Istanbul; max 20 years; Cyprus holding + Russia engineering team; Dec 2022 & Oct 2023 paperwork; five-year $12M Secret Service training-unit contract 2024; March undercover DHS denials; ~57 domains + bank accounts seized (Sep 19 warrant); Weissberg YouTube / Aug VA suit; BIS + DoW Office; presumed innocent. No justice.gov primary located. Headcount / other contract totals beyond sourced figures Undisclosed.