In short: The US Department of Justice charged Oxygen Forensics CEO Lee Reiber and co-owner Oleg Davydov with conspiracy to commit wire fraud. Prosecutors allege the company spent years hiding from federal customers that it was actually controlled by Russian nationals through a Cyprus-based holding company, while marketing itself as an independent American firm. Authorities seized the company's bank accounts and 57 domains. On October 3, 2026, Russian outlet SecurityLab.ru reported the European fallout: Romania is terminating its contract, Latvia has suspended use of the software, and London's Metropolitan Police has stopped working with the product.
What the software does and why it matters
Oxygen Forensic Detective is a digital-forensics tool: it extracts, recovers and analyzes data from smartphones and cloud services for criminal investigations — messages, location history, deleted files, and app passwords. That means it handles some of the most sensitive personal data a person has, often belonging to people who aren't even suspects (victims, witnesses, owners of recovered devices). The product has been used for over a decade by agencies in the US and Europe, including, according to the indictment, the Secret Service, the IRS and the US Army.
What the charges actually say
Prosecutors allege that five Russian nationals, including Oleg Davydov, controlled the company through a Cyprus holding structure. After Russia's invasion of Ukraine in 2022 and the resulting sanctions, their names were reportedly removed from corporate filings, and Lee Reiber became CEO, president and board chairman — so the firm could keep presenting itself to federal customers as an independent American company. The DOJ is careful to note the charges don't allege malicious code in the product itself or unauthorized access to extracted data — this is a case about concealed ownership and control, not a technical backdoor. The Record and CNBC covered the original charges on September 25, 2026.
How Europe is responding
Romania — which bought its most recent license just a month earlier, on August 27, for €13,000 — is terminating its contract. Latvia has suspended use of the software. London's Metropolitan Police has stopped using the product. European agencies emphasize that no confirmed data leaks or evidence of unauthorized access to extracted data have been found so far — these are precautionary moves, not responses to proven compromise.
What this means for ordinary users and their data
The direct lesson here isn't about one person — it's about trust in vendors that handle the most sensitive data in your life, whether that's government forensics software or a commercial app on your own phone. The case shows that a product's stated origin and its actual ownership can be two different things, and that's nearly impossible to verify from the outside. We've covered an adjacent angle before — who technically sees your traffic and data, and how to limit that exposure: how a VPN protects you from ISP surveillance.
What you can do now
- Compartmentalize what you trust to any single service. The less sensitive data sits in one place, the less damage any single vendor's compromise can do.
- Check who actually runs an app — not just the brand name, but the developer's jurisdiction and its data-handling terms, before granting it access to your phone.
- Use device-level encryption (a long screen-lock code, full-disk encryption) — this is the main defense against physical data-extraction tools specifically.
- Encrypt your network traffic. LiMP VPN won't protect a device that's already been seized and forensically examined, but it hides your real IP address and encrypts your connection — a separate layer of protection against traffic interception that doesn't depend on trusting any one forensics vendor.
Plans with a verified no-logs policy: LiMP VPN pricing. More breakdowns of privacy incidents and data leaks on the LiMP VPN blog.
Sources
- SecurityLab.ru — Oxygen Forensics' fall: European agencies cut contracts, October 3, 2026
- The Record — Digital forensics firm with US federal contracts covered up ties to Russia, DOJ alleges, September 2026
- CNBC — Virginia tech firm's CEO, Russian national charged with hiding firm's Russian ties from U.S. government, September 25, 2026