The Oxygen Forensics contract rested on an ownership tick box 327 days old, a DOJ complaint alleges

327 days between the tick box and the contract

On 18 September 2024 the US Secret Service signed a five-year contract for Oxygen Forensics software for its National Computer Forensics Institute (NCFI), with a ceiling of $12 million. The federal award record gives the date, the ceiling and the end date, 17 September 2029. According to the sworn affidavit filed with a criminal complaint, the award file held one statement about who owned the company: a certification in the government's System for Award Management (SAM), submitted on 27 October 2023, that Oxygen Forensics Inc had no immediate owner and no highest-level owner.

From 27 October 2023 to 18 September 2024 is 327 days. The ownership assurance behind a $12 million forensic software contract was, on the prosecution's account, a self-certified tick box that was 10 months and 22 days old on the day of award. The company's next annual certification, the first to name a Cyprus holding company as its owner, followed on 15 October 2024, 27 days after the award.

On 23 September 2026 the US Attorney's Office for the Central District of California announced that Lee Reiber, the company's chief executive, and Oleg Sergeyevich Davydov, a Russian national, had been arrested on a complaint charging them with conspiracy to commit wire fraud. Reiber was arrested in Idaho. Davydov was arrested at London Heathrow before boarding a flight to Istanbul, and the United States expects to seek his extradition. The prosecution's case is that five Russian nationals owned and controlled the company through Cyprus, and that its software was written in Russia.

What the complaint and affidavit allege

The press release is short. The complaint is not: it runs to a 42-page affidavit by a special agent of the Commerce Department's Bureau of Industry and Security, sworn by telephone on 18 September 2026 in Los Angeles (case 2:26-mj-05499). It was transmitted to the District of Idaho for Reiber's initial appearance and is public on the Idaho docket, 1:26-mj-00240, filed 21 September. We read it in full. It is one side's account, written to show probable cause, and it says so: it 'does not purport to set forth all' the agent's knowledge, and several Russian documents it quotes were machine translated.

The prosecution's account, as stated in the DOJ release of 23 September 2026 and the affidavit filed 21 September 2026

Allegation	Where it is stated
Five Russian nationals, including Davydov, owned Oxygen Forensics Inc through Oxygen Forensics Ltd, a Cyprus company that owned 100 per cent of it	Release; affidavit paras 6, 17
The same five owned the Russian company known as Oxygen Software LLC until September 2022 and now MKO Systems LLC	Release; affidavit paras 7, 31 to 33
The Russian company sold the same software under other names (MK Desktop, MK Expert Plus, MK Enterprise) to customers including the FSB	Release; affidavit paras 26, 30
One development team, mainly in Russia and directed by Davydov, wrote the software for all three companies, in a US-based AWS environment administered by Russian nationals	Affidavit paras 17, 93
After the 2022 sanctions the owners were removed from public filings and Reiber was installed as CEO, president and chairman, while the owners kept control	Release; affidavit paras 18, 47 to 49
Reiber falsely certified in SAM that the company had no immediate or highest-level owner	Release; affidavit paras 19, 60 to 62
US government customers paid more than $2 million after 7 June 2022, including the 2024 NCFI contract	Affidavit paras 23, 58
In March 2026 Reiber told people he believed to be DHS contracting staff that no one in Russia had any role in, or access to, development	Release; affidavit para 100

Two passages carry the story. In November 2023 a reporter asked Reiber who owned the company and whether it was connected to the Russian firm. The affidavit quotes his email to Davydov and two other owners: the reporting 'could destroy this entire opportunity', meaning the NCFI contract, and 'the current existence of this company hangs in the balance'. That email was sent on 29 November 2023, 33 days after the 27 October certification and 294 days before the award. The warning sign existed. On the affidavit's account, the award file ten months later still held only the certification that preceded it.

The control was a form, and the form asks about entities

The ownership question comes from FAR 52.204-17, 'Ownership or Control of Offeror'. The offeror ticks that it has or does not have an immediate owner. If it has one, it gives that owner's CAGE code and legal name, and ticks whether that owner is itself owned or controlled by another entity; if so, it names the highest-level owner the same way. The definitions are generous about control, listing 'ownership or interlocking management', shared facilities and 'common use of employees' as indicators. The mechanism is not. It is a declaration, renewed annually, entered by the supplier, and read by the buyer.

Three properties of that mechanism matter more than this case:

1. It is self-reported. Nothing in the provision requires anyone to test the answer. The affidavit says the Secret Service programme manager for the 2023 award 'personally checked' the SAM certifications and relied on them. Checking a self-certification tells you what the supplier said.
2. It ages silently. The certification is annual. An award file that holds the 'then-current' version, the affidavit's phrase, can hold one that is 11 months old, and nothing in the file says so.
3. It asks about entities. The form's slots take a CAGE code and a legal name. In this case the alleged owners were five individuals behind a Cyprus company. The October 2024 and September 2025 certifications named the Cyprus company and said there was no highest-level owner. The prosecution says that was false because the individuals controlled the Cyprus company. Whether it was false is for the court. The design point stands regardless: a form built around owning entities does not by itself surface the people behind a holding company.

A comforting label is not a control

The case is full of labels that sound like assurance. The affidavit says the NCFI sales presentation called the company 'an America[n] company' and 'a trusted U.S. company'. In 2024 a letter to European buyers said all 'compilation, coordination, code review, software build and deployment' happened in Virginia. In 2026 a public trust page and a 'Corporate Integrity and Operational Practice Statement' said the company had no development presence in any restricted jurisdiction. On the prosecution's account, each was false.

The build claim is the one software buyers should study. In March 2022, the affidavit says, Davydov explained to Reiber that the build 'is done automatically' and that he need only learn how to 'push' the button that starts compilation. Reiber had asked to learn it so he could 'say this is what I do or what We do in the US'. From then on the build was started in the United States. The code, the affidavit says, was still written, reviewed and managed in Russia.

If that account is right, a statement that the software was built in the United States would have been literally true and would still have told the buyer nothing about where the code came from. Build location is not code provenance. The same gap sits inside any attestation that describes where a pipeline runs rather than who can change what goes into it, which is why the affidavit's reference to the 2021 US executive order requiring attestations about 'the provenance of its code' is pointed.

The federal spending data adds a label of its own. USAspending records a 'domestic or foreign entity' value on each contract action. For direct awards to Oxygen Forensics Inc, every record from 2017 to July 2023 reads 'U.S. owned business'. A State Department order signed on 13 March 2024 reads 'foreign-owned business incorporated in the U.S.' A Drug Enforcement Administration order of 9 August 2024 reads 'U.S. owned business' again, and so does an Immigration and Customs Enforcement order first signed on 18 September 2024, the same day as the NCFI award, whose record was last updated by an option exercise on 27 June 2025. The State Department and DEA records from May 2025 on read foreign-owned. For more than a year the government's own data described the same supplier both ways, and the records do not show whether anyone noticed.

How federal award records labelled Oxygen Forensics Inc, from USAspending, accessed 28 September 2026. Direct awards only; resold purchases carry the reseller's label

Action date	Buyer	Ownership label on the record
2017 to 26 Jul 2023 (18 awards)	ICE, FBI, DEA, Coast Guard, Secret Service, State, IRS	U.S. owned business
13 Mar 2024	State Department	Foreign-owned, incorporated in the U.S.
9 Aug 2024	Drug Enforcement Administration	U.S. owned business
18 Sep 2024 (option exercised 27 Jun 2025)	Immigration and Customs Enforcement	U.S. owned business
8 May 2025 to 28 Aug 2026 (3 awards)	State Department, DEA	Foreign-owned, incorporated in the U.S.

Stated and not stated

What the release and affidavit establish as allegations, and what they do not say

Question	Stated in the complaint or release	Not stated
Was there malicious code?	The release says the complaint does not allege it	Any security finding about the software either way
Was customer data accessed?	The release says unauthorised access is not alleged	Whether any audit of data handling was done
Are the US and Russian products the same?	Affidavit: 'fundamentally the same products', same team	That they share a build, binaries or update channel
Did the owners help Russian surveillance?	A 2023 planning document weighed scenarios including 'assisting in surveillance'	That any such assistance happened
Who else bought the software?	Four US customers named as victims	Any UK customer; any link to other buyers
Is the software still in use?	A DHS supervisor relied on the trust page on 17 September 2026	What any agency has done with it since the arrests
Will there be a conviction?	Complaint only; defendants presumed innocent	Any indictment, plea or trial date

The row on surveillance is the one most likely to be over-read. The affidavit describes a shareholder document from February to May 2023, which the affidavit calls the 'Citadel' scenarios, that considered three scenarios in which the Russian state might seek ownership or control. In one, the owners would keep the company but 'begin assisting in surveillance'. The affidavit uses it to show the owners understood disclosure would end their Western business. It does not allege that any of the scenarios came about.

The UK angle, and what we could not find

Two UK facts are on the record. Davydov was arrested at Heathrow on Sunday 20 September, and the Justice Department's Office of International Affairs is assisting with what the release calls his provisional arrest and anticipated extradition. And the affidavit says that between June 2022 and January 2026 at least 128 wire transfers, about $19.05 million, went from the US company to accounts held by the Cyprus company 'located in at least the United Kingdom and Lithuania'. It does not say which banks, or how much went to each country.

We looked for UK public-sector purchases of Oxygen products. A search of Contracts Finder for the company and product names returned no notice naming them. That is not evidence that no UK force or agency uses the software: forensic tools are often bought below publication thresholds, through resellers or under framework call-offs that do not name the product. We found no primary source for UK use, so this piece makes no claim about it. A UK buyer that does hold these licences will know from its own asset register, which is the right place to look.

Method, interest and disclosure

The only detailed account is the prosecution's. An affidavit in support of a complaint is written to establish probable cause, the defence has not answered it, and some of its quotations are machine translations. We have quoted it as allegation throughout and used the defendants' names only as the Justice Department's release does. We have not named the co-conspirators, the reseller that held the NCFI contract, or the competitor whose accusation prompted the reporter's question, because the release does not.

Interests are worth stating. The affidavit says the November 2023 inquiry 'appears to have been prompted by' a Russian competitor's claim of stolen code, and that the February 2026 reports were, in the company's own reply, attributed to 'a terminated, disgruntled employee'. Neither motive changes what the certifications said. Competitors of any forensic vendor benefit from this story, and so do sellers of supply chain assurance services.

What to do, in the order worth doing

The question that exposes the gap

Most supplier assurance, in government and out of it, has the same shape as the SAM form: the supplier declares, the buyer files, and the declaration stays true until the next one. On the prosecution's account, this one sat in an award file for 327 days, through a reporter's direct question about ownership, and nothing in the process the affidavit describes would have carried that question to the buyer.

So the question for any team that signs contracts on the strength of a declaration is simple. If a journalist asked your supplier tomorrow who really owns it, how would you find out, and how old would the answer in your file be?