The US Department of War relied on software built in Russia and linked to FSB
The tool was used by the Russian secret service FSB to lock up a journalist.
Image by Cybernews
- US prosecutors allege Oxygen Forensics hid Russian ownership while selling digital forensic tools to US agencies.
- The Justice Department says the complaint does not accuse the software of containing malicious code.
- Oxygen won a 5-year Secret Service training contract after questions about its Russian ties.
- The FSB reportedly used related technology to unlock journalist Alsu Kurmasheva’s seized iPhone.
Key Takeaways by nexos.ai, reviewed by Cybernews staff.
A digital forensic tool trusted with sensitive US government contracts was secretly Russian-owned, with its software built in Russia and sold to Russian spy agencies, US prosecutors allege.
Virginia-based Oxygen Forensics sells a software tool, Oxygen Forensics Detective, that's designed to recover, preserve, and analyze data from smartphones, computers, and other digital devices.
Its tools are used by the US Department of War, the US Department of Homeland Security, and US Immigration and Customs Enforcement (ICE).
But according to a newly unsealed criminal complaint, the supposedly American company was controlled by Russian national Oleg Davydov and 4 other Russian citizens – the same group behind a Moscow company whose customers included Russia’s Federal Security Service (FSB).
Oxygen Forensics' CEO Lee Reiber was arrested in Idaho on wire-fraud charges and released on bail on Tuesday.
Davydov was arrested at London's Heathrow Airport 2 days earlier, with US authorities seeking his extradition.
US prosecutors said in a press statement issued on Wednesday that they have found no evidence the software itself was malicious.
"The complaint does not allege that the software contained malicious code or that it was used to gain unauthorized access to any customer's computer systems or data," the Justice Department said.
Secret Service training center bought tool despite probe
The US government alleges Reiber hid the company's Russian ownership and Russia-based development work while chasing lucrative US contracts.
When a reporter asked about those Russian ties in November 2023, Reiber allegedly warned Davydov and 2 other Russian owners that it "could destroy the entire opportunity."
That opportunity was a pending contract with the National Computer Forensics Institute, which trains state and local law enforcement and is run by the Secret Service.
Oxygen won the deal anyway, landing a 5-year NCFI software contract in September 2024.
OSINT investigator Cynthia Hetherington, who has written a book on due diligence, said that the news about the firm’s ownership came as a surprise, even to her. But, she added, there were lessoned to be learned.
"If this company had landed on my desk for due diligence, the Russian ownership and corporate relationships would have been exactly what I was looking for. I don't know where the government's vetting process failed, particularly if ownership was deliberately concealed."
Somewhere along the line, the process failed to identify a very significant foreign-risk issue,– says OSINT investigator Cynthia Hetherington, CEO of Hetherington Group.
"The cost of investigating a problem like this after the fact will dwarf what a serious background investigation would have cost before procurement," she added.
"For the OSINT community, the lesson is simple: investigate your tools with the same rigor you use to investigate everyone else."
Technology used by FSB to lock up journalist
The Russian connection extended to the code itself, prosecutors allege.
Reiber and the Russian owners concealed that the software was developed in Russia,– alleges the US Justice Department in a press statement.
The software for Oxygen was written and managed by a team in Russia under Davydov’s direction, in a cloud environment administered by one of the Russian owners.
According to the US government, Oxygen’s Russian operation was renamed MKO Systems after Moscow’s full-scale invasion of Ukraine and subsequent US restrictions.
The Insider report, citing Russian case files, claimed that the FSB used Mobile Criminalist to unlock an iPhone seized from Radio Free Europe/Radio Liberty journalist Alsu Kurmasheva after her detention in 2023.
Kurmasheva was subsequently convicted behind closed doors of spreading “false information.”
She was released 9 months later after a US-Russian exchange scheme.
OSINT tool in Russian ownership dispute
Krebs on Security reports earlier this month that the people-search service Radaris has Russian links.
Stay updated with our latest stories and follow us on social media
Be the first to discover new stories, ideas, and updates from our team.
Krebs has identified Russian-born Massachusetts residents Igor and Dmitry Lubarsky as figures behind Radaris, and associated businesses.
Lawyers representing Radaris have disputed these allegations, saying the brothers are of American or Ukrainian heritage.
Krebs also revealed that the publicly presented CEO of Radaris, Gary Norden, was a fictitious identity, something that the company's lawyer admits that the brothers invented.
