Abdullah Bozkurt/Stockholm
A Russian-controlled digital forensics company that sold investigative software to sensitive US government agencies allegedly used Turkey in multiple ways to obscure its Russian connections, including a Turkish passport that allowed a Russian shareholder to return to the management of its American affiliate under a new identity and a server in Turkey used to mask internet access originating from Russia, according to a newly filed US criminal complaint.
The 43-page affidavit, filed as part of a federal prosecution of Oxygen Forensics executives Lee Reiber and Oleg Sergeyevich Davydov, describes an elaborate corporate and technical architecture that prosecutors say was designed to conceal the fact that Oxygen Forensics Inc., marketed as an American digital forensics company, remained owned and controlled by Russian nationals after Russia’s invasion of Ukraine triggered sweeping US sanctions and heightened scrutiny of Russian technology.
The Turkey connection is particularly striking. According to the complaint, one of Oxygen’s principal Russian shareholders, identified by prosecutors only as “Co-Conspirator-1,” obtained a Turkish passport in 2023. The following year he returned to the management and board of the US company under a different name and identity even though he had previously been removed from its public filings as the company sought to distance itself from its Russian ownership.
Nordic Monitor has identified the Russian shareholder described by US investigators as “Co-Conspirator-1” as Oleg Fedorov, the longtime co-founder and former CEO of Oxygen Forensics, based on the biographical details in the federal affidavit and contemporaneous company records. According to US investigators, Fedorov later re-entered the company’s management under the name Fatih Osman using a Turkish passport obtained in 2023.
The affidavit says the same group also established a server in Turkey after discussing how to circumvent restrictions affecting connections from Russian internet addresses. Google and Microsoft records reviewed by investigators allegedly showed that the shareholders subsequently accessed their company accounts predominantly through Turkish IP addresses or US-based proxy and cloud infrastructure rather than directly from Russia.
The case therefore portrays Turkey not merely as a place associated with one shareholder’s second passport but also as part of the digital infrastructure allegedly used to disguise where the company’s Russian owners were actually operating.
A US criminal complaint filed in September 2026 alleges that executives and shareholders of Oxygen Forensics concealed the company’s Russian ownership and software-development ties while selling digital forensic technology to US government agencies. The filing also details the use of a Turkish identity and Turkey-based internet infrastructure by the company’s Russian owners:
A third Turkey connection surfaced when Davydov, the Russian co-founder and chief technology officer of the business, was arrested at London’s Heathrow Airport on September 20, 2026, shortly before he was due to board a flight to Istanbul, according to the US Department of Justice. US authorities are seeking his extradition. Reiber was arrested the same day in Idaho.
The most significant Turkey-related revelation concerns the identity of Fedorov who according to the complaint was a Russian citizen who lived primarily in Russia, co-founded the Russian Oxygen company with Davydov in 2000 and helped establish the US operation in 2013. He served as chief executive and president of the board and was responsible for international operations, software development and corporate strategy.
After Russia expanded its war against Ukraine in February 2022 and the United States imposed additional sanctions, the shareholders began discussing what the affidavit describes as the problem of having a “Russian” company in the United States.
According to prosecutors, they decided to remove the Russian shareholders from positions disclosed in Oxygen Forensics Inc.’s public corporate filings while leaving ultimate decision-making authority with them. A March 2022 internal document said Reiber would become CEO, president and chairman while “fateful decisions” would continue to be made by the Russian shareholders.
The arrangement was implemented in 2022. But two years later Fedorov returned. Amended US corporate filings submitted on November 14, 2024 added a man named “Fatih Osman” as president and secretary of Oxygen Forensics Inc. The company’s 2025 and 2026 filings subsequently identified Osman as president, secretary and chairman of the board.
According to the affidavit, investigators compared Fedorov’s Russian passport with the Turkish passport belonging to “Osman” and concluded they depicted the same person. Prosecutors say the Russian businessman had obtained the Turkish identity in 2023.
The practical effect was significant: Anyone examining the American company’s public records would see its president and chairman as a Turkish national rather than the Russian citizen who had been removed from the same corporate filings in June 2022, the affidavit states.
The complaint also cites an April 2024 exchange showing that Reiber apparently understood the sensitivity of putting the Russian shareholder back on the board. After being informed that the shareholder, using his Turkish alias, was returning to the board, Reiber questioned the move and recalled that the company had removed all non-US persons for “clear, and specific reasons.”
The Turkish identity was therefore not incidental to the prosecution’s account. It allegedly allowed a Russian shareholder who had disappeared from public filings amid sanctions concerns to return to a senior and publicly disclosed position without appearing in those records as the same Russian national.
The Turkish passport was only one element of the Turkish connection described by investigators. The affidavit says Oxygen’s shareholders were also concerned that internet connections originating in Russia could expose the reality that the company’s owners and developers continued operating there.
In June 2024 Reiber allegedly told Davydov that Oxygen’s security team had detected users connecting to a Microsoft application from Russian IP addresses. Reiber reminded Davydov that the team was supposed to use a virtual private network, or VPN, and asked him to ensure that nobody connected directly from Russian addresses.
But the effort had begun much earlier. According to page 31 of the complaint, internal shareholder documents from March 2022 show that the Russian owners discussed sanctions-related restrictions affecting Russian IP addresses and agreed that US accounts should be accessed through VPNs with US exit points.
One of the shareholders reported internally that “a server has now been set up in Turkey for access both from outside Russia and from within Russia.”
Federal investigators say records later obtained from Google and Microsoft showed that the shareholders’ email accounts were accessed almost exclusively from IP addresses in Turkey or through US-based proxy and cloud infrastructure, with direct Russian connections occurring only sporadically.
The allegation is important because prosecutors portray the Turkey-based infrastructure as part of a broader attempt to conceal the continued Russia-based management and development of a company selling sensitive digital forensic technology to American law enforcement.
The complaint does not identify where in Turkey the server was located, who operated or rented it or whether any Turkish company or individual knowingly assisted the shareholders.
Oxygen Forensics sells software designed to extract, analyze and organize evidence from mobile phones, computers, cloud services and other digital devices.
According to the affidavit, Oxygen Forensics Inc. in Virginia was wholly owned by a Cyprus company, Oxygen Forensics Ltd. That Cyprus company was in turn allegedly owned and controlled by five Russian shareholders.
A related Russian company, later renamed MKO-Systems, employed the developers responsible for the software. Its customers included Russia’s Federal Security Service, or FSB, as well as the Russian Investigative Committee and Ministry of Internal Affairs, according to investigators.
Prosecutors allege that despite the outward appearance of three separate companies in the United States, Cyprus and Russia, the businesses effectively formed a single structure controlled by the Russian shareholders.
The criminal complaint charges Reiber and Davydov with conspiracy to commit wire fraud. Investigators say that from at least March 2022 they and others sought money from US government customers while falsely representing that no foreign person owned or controlled Oxygen’s American entity and that its forensic software was developed in the United States.
Those customers included the US Secret Service and its National Computer Forensics Institute, Homeland Security Investigations, the Department of Homeland Security’s Office of Inspector General and the Department of Defense.
The shareholders allegedly continued to exercise substantial authority after disappearing from public corporate records. According to investigators, they set Reiber’s compensation, overruled him on payments, retained bank-account authority and continued directing the software development operation from Russia.
The appearance of the Russian shareholder under a Turkish identity also intersects directly with representations made to the US government about foreign influence. In July 2024 Oxygen was completing a US government Certificate Pertaining to Foreign Interests, known as an SF-328, as part of its dealings with national-security agencies.
The form specifically asked whether any non-US citizens served on the company’s board or in senior management and whether any foreign person had the direct or indirect power to control appointments or company decisions. According to the complaint, Oxygen answered “No.”
Investigators allege Reiber did not correct those answers even though the Russian shareholders continued exercising control and Fedorov had been brought back onto the board under his Turkish identity. The document was subsequently submitted to the Department of Defense.
That detail is significant because the alleged concealment was not simply about public appearance. Prosecutors argue that information about foreign ownership and control was material to decisions by federal agencies about whether the company could supply sensitive software.
US procurement officials interviewed by investigators said they would not have awarded or renewed the contracts had they known the company was Russian-owned or controlled.
In September 2024 the National Computer Forensics Institute awarded a five-year contract with a ceiling of $12 million for Oxygen’s forensic software through reseller Active Security Consulting LLC. The institute paid approximately $744,000 under the contract in 2024 and another $725,400 in 2025, according to the affidavit. Oxygen received corresponding deposits of approximately $707,000 and $689,000.
Across US government customers, contracts and purchases made after June 7, 2022 totaled more than $2 million, prosecutors say. The complaint alleges that Reiber repeatedly certified through the US government’s System for Award Management that Oxygen either had no immediate or highest-level foreign owner, despite documents showing that the Cyprus parent company and ultimately the Russian shareholders exercised ownership and control.
Investigators also accuse the company of disguising the Russian origin of its software development. According to the affidavit, Russian developers continued writing, reviewing and managing the code, while Reiber was given a limited role in initiating the software build on US-based cloud infrastructure.
The complaint quotes Reiber as asking to be taught the process so that he could say this was what “I” or “We” did in the United States. Prosecutors characterize his task essentially as launching a build process while the underlying software work remained in Russian hands.
The alleged effort mattered because US government buyers had expressed security concerns about Russian-developed software. When questions about Oxygen’s Russian links surfaced in late 2023, Reiber allegedly warned the Russian shareholders that public disclosure could destroy the company’s opportunity to secure the National Computer Forensics Institute contract and said the company’s existence “hangs in the balance.”
The Russian side of the corporate structure had particularly sensitive customers. According to the affidavit, Oxygen Russia, later renamed MKO-Systems, sold versions of the forensic software to the FSB, the Russian Investigative Committee and the Interior Ministry. Investigators allege that the software sold inside and outside Russia was fundamentally the same product, developed by the same team but marketed under different names.
The shareholders decided in 2022 to change the Russian company’s name and separate its internet presence from that of Oxygen’s international operations, steps prosecutors say were intended to make it more difficult for customers, regulators or investigators to trace the connection between the US and Russian companies.
Internal documents cited in the complaint also show shareholders discussing hypothetical “Citadel” scenarios in 2023 concerning possible Russian government control of the business. One scenario contemplated assisting with surveillance and partial ownership of the Russian business by a structure affiliated with the FSB.
The affidavit presents those discussions as evidence that the shareholders understood how damaging disclosure of Russian government involvement would be to Oxygen’s international business. It does not, however, establish that the contemplated surveillance arrangement was actually implemented.
According to the Justice Department, Davydov, 52, was detained at Heathrow Airport on September 20 as he prepared to board a flight to Istanbul. US authorities said they expect to seek his extradition from Britain. Reiber, 55, was arrested in Idaho and made his initial appearance in federal court on September 22 before being released on bond. The conspiracy charge carries a statutory maximum sentence of 20 years in prison if the defendants are convicted.
US authorities also obtained authorization to seize corporate bank accounts, dozens of internet domains and related cyber infrastructure as part of the investigation.
The US investigation gives Turkey an unusual role in the alleged concealment structure: A Russian shareholder acquired a Turkish passport and identity that prosecutors say allowed him to appear in American corporate filings as Turkish rather than Russian; a server in Turkey was allegedly established as Russian shareholders sought to mask their online location; their accounts subsequently generated substantial login activity from Turkish IP addresses; and Davydov was arrested while preparing to travel to Istanbul.
It is not clear how Fedorov acquired Turkish citizenship. Whatever process he used, however, citizenship applications of any kind are subject to security vetting that involves Turkey’s intelligence agency, MİT, while some categories of naturalization ultimately require a presidential decision or signature.
How Fedorov passed any security vetting conducted by MİT warrants further investigation. Such scrutiny is difficult in Turkey, where prosecutors rarely challenge the intelligence service over sensitive matters and MİT operates with broad legal protections and limited public accountability. The agency is headed by İbrahim Kalın, a close confidant of President Recep Tayyip Erdoğan.
Oxygen’s operations in Turkey would also have required local commercial arrangements and, depending on the nature of its activities, compliance with licensing and regulatory requirements. There is no public indication that the company encountered difficulties in Turkey while establishing the logistical and technical infrastructure described in the US court filing.
In fact Nordic Monitor’s investigation found out that Oxygen Forensics had developed a substantial commercial footprint in Turkey, supplying its digital forensic technology through local distributors to a market dominated by law enforcement, military and other government customers.
The most detailed picture comes from Turkey’s own Competition Authority (Rekabet Kurumu), which examined the country’s mobile digital-forensics market as part of an investigation involving Istanbul-based EMT Elektronik and Swedish forensic technology company Micro Systemation AB (MSAB).
In a decision dated October 23, 2025 and published in August 2026, the Competition Authority identified Oxygen Forensic Detective as one of the major mobile forensic products sold in Turkey and listed EMT Elektronik as its distributor. The authority said foreign forensic technology companies generally operate in Turkey through local distributors rather than selling directly to end users.
The decision also revealed that Oxygen had more than one distribution channel for part of the period under examination. While EMT distributed Oxygen products throughout 2020-2024, Turkish cybersecurity company Komtera Bilişim Teknolojileri also distributed Oxygen’s mobile forensic products in 2021 and 2022 before ending its commercial relationship with the company in 2023.
The investigation provides perhaps the clearest independent indication of just how important Turkey had become for Oxygen. According to the Competition Authority, Oxygen and Israeli forensic technology company Cellebrite were the two leading suppliers in Turkey’s mobile digital-forensics market in 2020. After Cellebrite stopped selling in Turkey beginning in 2021, much of its market share shifted to Oxygen and several other vendors.
Oxygen’s share increased continuously between 2020 and 2023, the authority found. Although its share declined somewhat in 2024 as South Korean-linked competitor ACE Lab increased its sales, Oxygen remained the market leader. The precise percentages were redacted as commercially sensitive information, but the authority disclosed that Oxygen’s 2024 market share was approximately three times that of its nearest competitor, ACE Lab.
The finding is significant because it establishes from an official Turkish government source that Oxygen was not a marginal supplier operating on the periphery of the Turkish market. It had become one of the country’s dominant providers of technology capable of extracting and analyzing data from mobile phones and other electronic devices.
The Competition Authority also described the customer base for such products. It said the specialized technology is sold to a limited group of buyers consisting primarily of law enforcement agencies, the military, government authorities performing regulatory or inspection functions and organizations conducting internal investigations.
EMT told competition investigators that it sold mobile forensic products by participating in tenders issued by government institutions or by submitting offers directly to those agencies, providing further evidence that government procurement formed an important part of the Turkish business.
EMT continues to openly market Oxygen Forensic Detective in Turkey. Its Turkish-language product material says the software can extract and analyze information from tens of thousands of iOS and Android devices as well as computers, cloud accounts, drones and Internet of Things devices. It advertises capabilities including access to data associated with WhatsApp, Telegram, iCloud, Google, Microsoft, Facebook and other services, along with facial categorization, optical character recognition and other analytical tools.
There is also direct documentary evidence that Oxygen technology was purchased for use by one of Turkey’s most important state forensic institutions. In March 2023 the Council of Forensic Medicine (Adli Tıp Kurumu), an institution under the Ministry of Justice, issued a public procurement notice covering software for its Digital Forensics Specialization Department in Istanbul. The tender called for renewal of two existing Oxygen Forensic Detective licenses and the purchase of four additional licenses, demonstrating that the agency was already using the software before the 2023 procurement.
On February 17, 2026 the Council of Forensic Medicine initiated another procurement, this time seeking an Oxygen Forensic Detective Network license for 15 simultaneous users for three years. The procurement was conducted through Turkey’s direct-purchase procedure under the Justice Ministry’s Council of Forensic Medicine.
Tender-result databases identify EMT Siber Teknoloji A.Ş., the Turkish Oxygen distributor, as the contractor for the 2026 purchase. That transaction is especially noteworthy because it took place in February 2026, years after US investigators say Oxygen’s Russian owners had begun restructuring the company and masking their Russian connections following the February 2022 invasion of Ukraine.
The commercial relationship was accompanied by extensive marketing and outreach in Turkey. On June 13, 2024 EMT and Oxygen jointly organized EMT & OXYGEN Tech Day ’24, an event specifically attended by representatives of law enforcement agencies, government institutions and the private sector. EMT described the meeting as an opportunity for technical information sharing and cooperation.
The two companies repeated the event in Ankara on February 6, 2025, holding EMT Cyber & OXYGEN DAY ’25 at the Wyndham Hotel. EMT publicly thanked law enforcement agencies, government institutions and private-sector representatives who attended. The relationship between Oxygen and EMT was sufficiently important that the Turkish distributor received repeated recognition from Oxygen’s international management.
Oxygen awarded EMT the 2023 Top Partnership in EMEA award, citing sales performance, customer support and commitment to customers. Oxygen’s own social-media announcement congratulated EMT for its performance in sales and support. A year later EMT received Oxygen’s 2024 EMEA Growth Award at Oxygen’s International Partner Summit in Prague. EMT said the award reflected its continued growth and strong partnership with Oxygen in the Europe, Middle East and Africa region.
By 2025 EMT was publicly describing itself as Oxygen Forensics’ authorized distributor in Turkey when its representatives attended Oxygen’s Partner Summit in Amsterdam. These repeated awards and joint events indicate that Turkey had developed into an important market within Oxygen’s broader international sales network rather than merely serving as a convenient location for technical infrastructure.
Oxygen’s visibility in Turkey extended beyond reseller events. At the European Network of Forensic Science Institutes’ Forensic Information Technology Working Group annual meeting in Istanbul in October 2025, Oxygen Forensics appeared as a Gold Sponsor and was given its own presentation slot. EMT Electronics was separately listed as a Gold Sponsor.
The event was organized in Istanbul with participation from the Turkish Gendarmerie’s forensic apparatus, and the conference program also included a presentation by the Digital Forensic Department of Turkey’s Council of Forensic Medicine. The conference therefore brought together Oxygen, its Turkish distributor and Turkish state forensic institutions in the same professional setting at a time when, according to US investigators, Oxygen’s true ownership and Russian development structure remained concealed from government customers abroad.
EMT’s broader customer references further demonstrate the type of government environment in which the distributor operates. The company’s public reference material lists numerous sensitive Turkish state bodies, including units of the national police, gendarmerie, armed forces and other government institutions.
Taken together, the records add another dimension to the Turkey connection revealed by the US investigation.
US investigators allege that Oxygen’s Russian shareholders used Turkey-based network infrastructure to conceal connections originating in Russia and that one of the company’s Russian owners later re-entered the American company’s management under a Turkish identity. Separately, Turkish government and corporate records show that Oxygen had built a thriving business in the country through local distributors and had become a leading supplier to a market centered heavily on police, military and government customers.
The convergence is notable: Turkey served simultaneously as an important market for Oxygen’s forensic technology and, according to US prosecutors, as part of the infrastructure used by its Russian owners to obscure their continuing connections to Russia.
Those details could become significant as the case in the US develops, particularly because the prosecution’s theory places both the Turkish identity and Turkey-based digital infrastructure inside a broader effort allegedly intended to disguise the continued Russian ownership and operation of a contractor serving sensitive US law-enforcement and national-security customers.
