Everyone Suddenly Knew Oxygen Forensics Was Guilty

DOJ alleges hidden Russian ownership and a fake U.S. build. That is not malware, FSB control, or proof the industry already did the work.

The Internet solved the Oxygen Forensics case fast.

Within hours of the Department of Justice announcing the arrests of Oxygen Forensics CEO Lee Reiber and Russian national Oleg Davydov, the Internet had completed its own case file. Oxygen was an FSB operation, the software had malware, customer data went to Russia, and one Reddit commenter was already claiming DOJ had suspended all Oxygen contracts. Suddenly, plenty of people announced that they had known it all along.

Some people certainly knew Oxygen had Russian roots. That part wasn’t buried. Kim Zetter referred to Oxygen’s Russian ownership in reporting going back to 2016. Forbes reported in 2017 that Oxygen had been set up in Russia by Oleg Fedorov and Oleg Davydov and described its Moscow development operation while documenting U.S. government purchases of the software.

Anyone claiming the words Oxygen and Russia had never appeared in the same sentence before September 2026 hasn’t been paying attention.

The criminal allegations released this week are considerably more specific, and considerably more serious.

Before going further, a disclosure. I used a screenshot from Oxygen Forensics in the first edition of Placing the Suspect Behind the Keyboard way back in 2013. About three years ago, I appeared on an Oxygen Forensics podcast hosted by Lee Reiber. I have never owned an Oxygen license, used Oxygen software in an actual case, or had a financial interest in the company or its products. I don’t have money riding on Oxygen surviving, disappearing, winning, losing, or turning into a pumpkin.

What I care about is the evidence and how this case affects tooling in DFIR.

What Was Actually Charged

The federal criminal complaint charges Reiber and Davydov with conspiracy to commit wire fraud under 18 U.S.C. § 1349. Reiber was arrested in Idaho and released on bond following his initial appearance. Davydov was arrested at Heathrow Airport while preparing to fly to Istanbul, and the United States expects to seek his extradition. If convicted, each faces a statutory maximum of 20 years.

Those allegations sound bad because they are bad. It also remains a criminal complaint, which is not a conviction.

A federal magistrate judge found probable cause sufficient for the criminal complaint and arrest warrants. Nobody has been convicted. DOJ says the allegations remain allegations and that both defendants are presumed innocent unless proven guilty beyond a reasonable doubt.

The government’s theory gets more interesting when you read the affidavit instead of stopping at the headline.

Prosecutors allege that Oxygen Forensics Inc., the Virginia company selling digital forensic software to U.S. government agencies, continued to be owned and controlled by five Russian nationals through a Cyprus holding company. According to DOJ, public corporate filings changed after Russia invaded Ukraine, removing Russian officers and owners while the underlying ownership and control continued.

Federal procurement certifications matter. The government alleges Oxygen submitted representations stating that it had no immediate owner or highest-level owner, and later disclosed its Cyprus parent while still failing to identify the Russian owners above it. Those certifications weren’t trivia buried in a vendor-registration form. Ownership and foreign control can matter quite a bit when the customer is the United States government buying software used in investigations and national-security environments.

Then there is the development question.

According to the affidavit, the software continued to be written and managed by a Russian development team under Davydov. The government alleges that Reiber was given a nominal role in a U.S.-based build process in 2022. Messages described in the affidavit have Reiber essentially initiating a build on U.S. cloud infrastructure after the underlying software development had occurred elsewhere. DOJ alleges the code continued to be written and managed in Russia.

Anyone who has worked around software development understands why that matters. Starting a build process in Virginia doesn’t magically relocate the people who wrote, reviewed, maintained, and managed the code.

What DOJ Did Not Allege

This is where the story started growing extra body parts.

DOJ specifically said prosecutors are not alleging that Oxygen’s software contained malicious code or that anyone obtained unauthorized access to customers’ computer systems or data. Zetter made the same distinction in her September 23 reporting.

The affidavit says the Russian company, MKO Systems, sold the software in Russia under different product names to customers reportedly including the FSB, the Russian Investigative Committee, and the Russian Ministry of Internal Affairs. That deserves scrutiny. So do the government’s allegations concerning Russian ownership, Russian control, and Russian development.

None of that gives us an FSB stock certificate for Oxygen Forensics Inc.

Maybe investigators possess evidence proving something more but don’t put all in an affidavit of probable cause (this is typical of any investigation to only publish the bare minimum in a complaint/affidavit). They may have terabytes of evidence we haven’t seen. More charges may come. More defendants may appear. The case could become much uglier.

As DFIR professionals, we don’t get to fill the gaps ourselves while we wait.

The Russian Origins Were Never the Secret

This is where the “everyone knew” crowd gets half a point.

Oxygen’s Russian origins were public.

Zetter says she referenced Oxygen’s Russian ownership in a 2016 Intercept article. Forbes reported in April 2017 that Oxygen had been founded in Russia, and later that year Thomas Brewster wrote an entire article about Russian forensic companies selling tools to U.S. law enforcement and government agencies. That article discussed Oxygen’s Russian founders, Moscow development, and federal contracts.

By 2023, the questions had moved beyond where Oxygen started. Forbes reported on continuing connections involving Oxygen and MKO after a Russian lawsuit alleged that code used by MKO also appeared in Oxygen’s product. The article identified a Cyprus entity and raised obvious supply-chain questions for government users.

That reporting deserved attention. It still didn’t establish the specific ownership, control, procurement certifications, communications, and representations the government now alleges were fraudulent.

This wasn’t information recovered from a deleted Telegram account last Tuesday. There had been smoke around parts of the relationship for years. What matters now is what the evidence says happened later.

Knowing that a company began in Russia doesn’t tell you what representations it subsequently made to federal contracting officers. It doesn’t establish who beneficially owned the company in 2024. It doesn’t establish where source code was being developed after corporate filings changed. It doesn’t tell you whether statements submitted through SAM.gov, the federal government’s contractor registration and certification system, were truthful.

Those questions require evidence.

So when somebody says, “We always knew Oxygen was Russian,” my response is basically: Okay. And?

That gets us to the starting line.

Foreign Forensic Software Is Nothing New

There is another piece of this conversation that is getting lost.

Foreign-developed forensic software is common in the United States. X-Ways Forensics is German. Cellebrite came out of Israel. MSAB is Swedish. Magnet Forensics started in Canada. Nuix came out of Australia. American examiners and government agencies have used foreign-developed forensic tools for decades. X-Ways still describes its software plainly as “computer forensics software made in Germany.”

I saw federal concern about this firsthand long before Oxygen became a headline.

In 2014, I gave a presentation on X-Ways Forensics in Seattle. It ran an hour or two. The room wasn’t huge, but it was standing-room-only, and it seemed like half the FBI forensic world was sitting in it.

Nobody was asking me whether X-Ways worked. The question I kept getting was how the FBI was going to get approval to buy forensic software from a German company.

I gave my opinion on how I thought it could be done. That eventually turned into me writing a memo supporting the argument and introducing one of the agents to Stefan Fleischmann, the CEO and developer of X-Ways. The discussion continued for quite a while after the presentation.

That experience stuck with me because the questions I heard weren’t about German programmers secretly working for German intelligence or X-Ways shipping case evidence to Berlin. They were about whether a federal agency could satisfy its procurement and security requirements before putting foreign-developed software into its forensic environment. That is a perfectly reasonable question.

A company’s country of origin tells you where part of its story started. It doesn’t answer who owns the company today, who controls it, where development actually happens, who has access to the source and build environment, or whether representations made to a government customer are true. Those questions require due diligence from the potential buyer.

The allegation against Oxygen goes far beyond Russians writing forensic software. Russian developers writing software is not a federal crime. The government alleges that ownership, control, and development remained tied to Russia while materially different representations were being made to U.S. government customers and through the federal contracting process.

The border isn’t the evidence. The representations about what was happening on the other side of it are.

What Changed After 2022

According to the affidavit, the conduct at the center of the criminal case accelerated after Russia invaded Ukraine and U.S. sanctions expanded.

Russian names disappeared from public corporate filings. The Russian Oxygen entity became MKO Systems. Federal ownership certifications followed. Prosecutors allege that software development continued in Russia while Oxygen represented to government customers that development occurred in the United States.

DOJ says that in November 2023, a reporter asked Reiber about Oxygen’s ownership and its relationship with the Russian company. Reiber allegedly warned Davydov and two other Russian owners that public reporting “could destroy this entire opportunity,” referring to the pending National Computer Forensics Institute contract, and that the company’s existence hung in the balance. NCFI later awarded the five-year contract in September 2024.

This is important because it goes directly to whether the Russian connection was material to the business opportunity and what the people involved understood about it.

The government alleges that Reiber and Oxygen continued making representations regarding ownership and control. Then, in March 2026, undercover federal agents posing as DHS contracting personnel conducted a recorded call with Reiber and another Oxygen executive. According to the affidavit, Reiber denied Russian ownership, Russian control, Russian involvement in development, and Russian access to the development environment.

Days later, DOJ says Reiber authored a statement for Oxygen’s website declaring that the company had no development presence in a restricted jurisdiction. Prosecutors allege the development team remained in Russia under Davydov’s direction.

That recorded call, assuming the affidavit accurately describes it, is a different class of evidence from somebody on Reddit saying they always had a bad feeling about the company. The spoken word is strong in litigation, especially when it is against one’s penal interest.

Four Leaps That Happened Immediately

The Reddit discussions are almost a laboratory experiment in what happens when suspicion gets a shot of meth.

Before DOJ announced the arrests, a September 21 thread asked whether rumors about Oxygen’s Russian connections had merit. Replies quickly moved beyond asking questions. One commenter said Oxygen was “100%” tied to Russia and the FSB and suggested using it meant providing data to the Russian government. Another claimed DOJ had already suspended all contracts with Oxygen.

I have yet to find an authoritative government source substantiating that blanket contract-suspension claim.

Then the arrests became public and the leaps got easier.

Fraud became malware. Russian ownership became FSB control. “We always knew” became proof that the government’s allegations had been obvious all along. A business relationship became evidence of operational control.

The funny thing about confirmation bias is that getting the final answer right doesn’t cure everything that came before it.

If I decide Bob murdered Fred because Bob looks like a murderous bastard, and six months later DNA proves Bob killed Fred, my original investigative reasoning still sucked. The DNA didn’t travel backward through time and upgrade my hunch into competent analysis.

Read the Evidence in Order

A Reddit post is useful for showing what people are saying, feeling, and believing. It is a terrible substitute for the underlying evidence.

An FBI affidavit carries considerably more weight because an identified federal agent has sworn to facts supporting probable cause and cites records, messages, interviews, financial information, corporate documents, and other evidence.

A probable-cause affidavit can also contain hearsay, investigative conclusions, and evidence selected by the government before the defense has had an opportunity to challenge it. It carries far more evidentiary weight than a Reddit post and considerably less than evidence tested in court.

That’s why the legal process continues.

The Oxygen website being dark belongs in the same category of disciplined thinking. DOJ says the government obtained a warrant authorizing seizure of corporate bank accounts, approximately 57 domains, and other cyber infrastructure, with domains and related infrastructure seized on September 20.

The website being dark proves that the website is dark.

It doesn’t analyze source code for us. It doesn’t tell us whether customer evidence was compromised. It doesn’t establish FSB operational control. DNS errors remain incapable of giving sworn testimony.

What This Means for Existing Oxygen Cases

This part matters more to working examiners than the social-media fight.

If you used Oxygen in an existing examination, preserve your case. Preserve the tool version. Preserve your examination notes, reports, logs, exports, hashes, screenshots, and whatever acquisition information you have. Preserve the original evidence according to your normal procedures. If an important result can be independently reproduced with another validated method, consider doing it.

Do not start panic-deleting reports or case material because the CEO was arrested. For installed Oxygen software, follow whatever security, procurement, legal, or agency direction applies to your environment.

Alleged corporate misconduct and the reliability of a specific forensic result are separate evidentiary questions. If Oxygen parsed a SQLite database and reported a message at a particular timestamp, the useful question is whether that artifact can be independently validated against the underlying data. The nationality of a developer, standing alone, does not establish whether that parsed artifact is accurate.

The provenance of the software may become relevant to foundation, discovery, expert examination, agency policy, procurement, or admissibility arguments. Those issues need to be handled case by case. Pretending every Oxygen extraction suddenly evaporated on September 23 is about as forensic as throwing the evidence drive out the window because you don’t like the vendor.

If I had a significant case involving an Oxygen-only result today, I’d document the heck out of it and verify what could reasonably be verified independently. If my report relied on an Oxygen-only interpretation that I could not reproduce another way, I’d want that identified now rather than when opposing counsel asks about it six months from now.

That’s what we should have been doing before this happened anyway.

What to Demand From Vendors Now

There is a legitimate lesson for forensic vendors here, and it goes beyond Russia.

We ask forensic vendors to give us software capable of bypassing locks, exploiting devices, obtaining elevated privileges, running agents, and extracting data the device owner tried to protect. Then sometimes we ask remarkably few questions about who actually wrote the software, who can change it, and who controls the company shipping it.

That needs to change.

I want to know who owns the company. I want to know where development happens. I want to know who can access the source and build environment. And I want some reasonable way to check claims made about those things. This strongly applies to “vibe-coded” and “vibe-assisted” forensic tools. Does the ‘developer’ actually know what the source code does and how it does it or did they prompt it into existence?

The Affidavit Is Serious Enough

The allegations in the federal affidavit are ugly.

If the government can prove that Oxygen’s actual ownership and control were concealed, that development continued in Russia while federal customers were told otherwise, and that corporate and procurement representations were knowingly engineered to disguise those facts, prosecutors already have a serious case to make.

We don’t need malware that DOJ didn’t allege. We don’t need to promote every Russian business relationship into FSB operational control. And we don’t need digital forensic practitioners lowering their own evidentiary standards because this particular story is entertaining.

If a fact comes from the affidavit, say it comes from the affidavit. If it comes from a corporate record, say that. If a reporter established it, cite the reporter. If some guy on Reddit says DOJ cancelled every contract while another guy announces that the software shipped customer data to Moscow, maybe resist the urge to convert that into a finding of fact before lunch.

There is enough here to be concerned about. There is enough here to be angry about if the allegations are proven. There is enough here to ask some very uncomfortable questions of Oxygen, its executives, its distributors, government procurement officials, and perhaps the forensic software industry generally.

There is enough.

There is no need to invent the rest.

Sources

U.S. Department of Justice. “Tech CEO, Russian National Arrested on Complaint Alleging They Hid Russian Ownership and Development of Software Sold to U.S. Government.” September 23, 2026.
https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

United States v. Lee Reiber and Oleg Sergeyevich Davydov, Case No. 2:26-mj-05499-DUTY, U.S. District Court for the Central District of California. Criminal Complaint and Affidavit.
https://www.courthousenews.com/wp-content/uploads/2026/09/oxygen-forensics-criminal-complaint.pdf

Kim Zetter. “When the FBI Has a Phone It Can’t Crack, It Calls These Israeli Hackers.” The Intercept. October 31, 2016.
https://theintercept.com/2016/10/31/fbis-go-hackers/

Thomas Brewster. “US Immigration Splurged $2.2 Million On Phone Hacking Tech Just After Trump’s Travel Ban.” Forbes. April 13, 2017.
https://www.forbes.com/sites/thomasbrewster/2017/04/13/post-trump-order-us-immigration-goes-on-mobile-hacking-spending-spree/

Thomas Brewster. “Meet The Russians Helping The Feds Hack Silicon Valley.” Forbes. August 30, 2017.
https://www.forbes.com/sites/thomasbrewster/2017/08/30/russian-hackers-help-us-with-encryption-nightmare/

Thomas Brewster. “Russian Hackers’ Lawsuit Reveals Weaknesses In Apple’s iOS 16.” Forbes. December 4, 2023.
https://www.forbes.com/sites/thomasbrewster/2023/12/04/russian-hacker-lawsuit-exposes-flaws-in-apples-ios-16/

Kim Zetter. “US-Based Digital Forensics Firm Hid its Russian Ownership from U.S. Government Customers.” ZERO DAY. September 23, 2026.
https://www.zetter-zeroday.com/us-based-digital-forensics-firm-hid-its-russian-ownership-from-u-s-government-customers/

Edvard Pettersson. “Feds accuse Secret Service software provider of hiding Russian ties.” Courthouse News Service. September 23, 2026.
https://www.courthousenews.com/feds-accuse-secret-service-software-provider-of-hiding-russian-ties/

Reddit. “Oxygen Forensics.” r/digitalforensics. September 21, 2026.
https://www.reddit.com/r/digitalforensics/comments/1wmsw4h/oxygen_forensics/

X-Ways Software Technology AG. “X-Ways Forensics.”
https://www.x-ways.net/

MSAB. “30 Years of Excellence.”
https://www.msab.com/updates/30-years-of-excellence/

Cellebrite. “About Cellebrite.”
https://cellebrite.com/en/about/

Magnet Forensics.
https://www.magnetforensics.com/

Nuix. “Our History.”
https://www.nuix.com/our-history

Timeline

The article is by me, the timeline by ChatGPT.