On October 15, 2024, in a hotel ballroom in Alexandria, Virginia, across the Potomac River from Washington, a former US Secret Service agent stood in front of an audience of technology experts and made a sales pitch for a powerful piece of software.
Made by a company called Oxygen Forensics, the software extracts data and files from mobile phones, computers, and other electronic devices, even breaking through password encryption. It is used by the US Defense Department, the Secret Service, Homeland Security, the Federal Bureau of Investigation. Dozens of federal and local police agencies across the United States and Europe, in fact.
In a video of the presentation, obtained by RFE/RL, the former agent, Konstantinos “Gus” Dimitrelos, extols Oxygen software’s powerful capabilities. As an example, he brags that he used it to pull tens of thousands of files from a copy of a hard drive from a laptop computer belonging to Hunter Biden -- the son of then-US President Joe Biden.
“Oxygen is my number one tool. It's the only tool that I use. It's the only tool that I teach. I love it. I love it,” Dimitrelos said. “For a lot of reasons, but number one, it allows me to authenticate. So what I was able to do is recover data from this laptop.”
“So I get a call a couple years ago. Says ‘I got a laptop’,” Dimiterlos explained to the audience. “‘What is it?’ ‘It's the Hunter Biden laptop.’ I'm like, ‘Oh, it's the Hunter Biden laptop, is it?’”
Dimiterlos was alluding to a scandal that roiled US politics during the campaign for the 2020 presidential election, in which Hunter Biden’s father, Joe, defeated incumbent Donald Trump.
Fast forward two years: On September 23, 2026, the Justice Department announced charges against two Oxygen executives for allegedly lying about the company’s true ownership and control.
Oxygen Forensics is in fact, federal authorities alleged, Russian-owned and Russian-controlled.
Dimiterlos’s presentation is a window on how widely used Oxygen’s software was, until recently, anyway -- embraced by experts in the digital forensics industry, and police and intelligence agencies in the United States, Europe, and around the world. The new criminal accusations, stemming from the software’s ownership, have stoked fears about its use -- or potential misuse.
“Not every software company with Russian owners does suspicious things, That said, historically, legitimate companies do not structure themselves this way."
Dimitrelos, who did not respond to e-mails requesting comment, was hired by the Washington Examiner newspaper to authenticate the Biden hard drive. His effort wasn’t the first: The FBI said it verified the laptop’s ownership earlier. The Washington Post enlisted outside experts for its own analysis of some of the data.
Dimitrelos is, however, the only person known to have used Oxygen Forensics software on the laptop. He claimed that he recovered more files from its hard drive -- including tens of thousands of deleted files -- than other analyses.
The US version of the software is identical to the Russian version, according to Russian activists as well as a former Oxygen employee who has filed whistle-blower complaints with the US government.
In fact, it's the same software that Oxygen -- which changed its Russian name to MKO-Systems -- supplies to the Federal Security Service, Russia’s main intelligence agency, and other Russian entities.
Five Russian citizens who are the named owners of MKO-Systems -- identified as “co-conspirators” in the court filing -- are the same five behind Oxygen Forensics, authorities charged.
One of them is the company’s chief technology officer, a Russian citizen named Oleg Davydov, who was arrested at London’s Heathrow Airport and jailed pending expected extradition to the United States. Oxygen’s American CEO, Lee Reiber, was arrested in Idaho on the same day, September 20, and released on bail.
In February, the Secret Service canceled a five-year contract it had signed with Oxygen, citing “security risks.” The State Department, meanwhile, signed a new contract in August, just a few weeks before criminal charges were announced.
British and European police agencies are now scrambling to halt use of Oxygen’s software after the news of its Russian background became public.
'You're Telling Me They’re Not Putting In Backdoors?'
Oxygen’s software is powerful, according to industry experts, which is partly why it is popular.
What’s unclear is whether it is dangerous; for example, containing malicious code or a “backdoor” to allow hackers or outsiders access to extracted data.
"Not every software company with Russian owners does suspicious things," said Runa Sandvik, a Norwegian-American digital security expert. "We don’t have any hard evidence to suggest that the software did anything other than what it was supposed to do.”
“That said, historically, legitimate companies do not structure themselves” this way, she added.
Other major companies in the digital forensics industry include Cellebrite, an Israeli firm that sued Oxygen in 2015 for copyright infringement. In that suit, Cellebrite also alleged Oxygen Forensics was in fact controlled by Russian owners.
“You’re telling me that the Russians who owned and coded this shit, they’re not using, putting in backdoors? They’re not using it for their own purposes? Bullshit. Pardon my French.”
Oxygen “had contracts with numerous countries, which tells us that it can compete with other players in the space, so based on that I’d say it’s accurate to describe it as a powerful piece of software,” Sandvik said.
In its announcement, the US Justice Department did not say the software contained malicious code or was used to gain unauthorized access. It said only that the criminal complaint “does not allege” that.
In a statement to RFE/RL, the Secret Service said use of Oxygen software “was immediately discontinued in February 2026 after security risks were identified by the agency. This program was used exclusively in air-gapped environments and there is no evidence that any sensitive information was compromised.”
"Air-gap" refers to computer networks that are isolated from unsecured networks, such as the wider Internet, to keep hackers or cyber intruders from gaining access, or to prevent the spread of malware.
The Defense Department did not respond to a request for comment.
In an e-mail to RFE/RL, the State Department, which signed a new contract in August, declined to say whether it continues to use the software., or whether it had any concerns about its security risks.
Marianne Meagher, who oversaw Oxygen Forensics’ sales to federal government agencies, said she had no idea the company was owned and controlled by Russian citizens.
“This software is so sophisticated. If you can use it to crack into anything, anywhere they did work, and you’re owned by Russians?” she said in an interview. "That’s problematic."
“You’re telling me that the Russians who owned and coded this shit, they’re not using, putting in backdoors? They’re not using it for their own purposes? Bullshit,” she said. “Pardon my French.”
“It sucks that Oxygen lied to the feds, but there is a bigger, bigger picture here,” she added.
Putting in a backdoor is “something that would be technically doable,” Sundvik said, “but I would assume US authorities would have the ability to check for and prevent it.”
Radio Moscow
Oxygen Software was founded in Russia in 2002 by Davydov and another man, Oleg Fyodorov.
Also listed as a co-founder was the Moscow Research Institute of Radio Communications, a former state entity that produces satellite communications systems and develops missile electronics, among other things. The institute was privatized in the early 1990s.
Fyodorov worked for the institute, as did his father, Yevgeny, who was a prominent Soviet and Russian specialist in military radio communication systems.
Until 2015, Oxygen Software was physically located on the institute’ premises. That year, the company moved its offices and changed its name to MKO-Systems -- the Russian acronym for the name of its lead product: Mobile Forensic Detective.
Two years prior, Davydov established Oxygen Forensics, based in the Washington suburb of Alexandria, Virginia. Reiber, a former Idaho police officer with experience in extracting data from mobile devices, joined the company in 2015.
Inside Russia, Oxygen’s software became an industry leader, popular among law enforcement agencies like the Investigative Committee and the Interior Ministry, and the Federal Security Service, or FSB.
It’s unclear when exactly the Moscow Research Institute ceased being listed as a co-owner.
But after the institute went bankrupt in 2022, it was bought by a group of investors that included Eduard Bendersky, a former FSB special forces officer. Bendersky’s son-in-law is Maksim Yakubets, a programmer who developed a notorious form of ransomware known as Evil Corp. Yakubets was indicted by US authorities in 2019, and is now on the FBI’s most-wanted list.
In 2024, US and British authorities called Bendersky a “key enabler of Evil Corp.”
RFE/RL was unable to establish a connection between Bendersky and Oxygen Software.
MKO-Systems received an e-mail from RFE/RL seeking comment, but did not respond. Fyodorov did not respond to an e-mail seeking comment. Davydov, who remained in British custody pending possible extradition, could not be reached for comment.
US Investments
In Russia, the Mobile Forensic Detective software is used widely, according to activists and experts, to break into electronic devices, often as part of politically motivated prosecutions.
Among the targets: RFE/RL journalist Alsu Kurmasheva, who was arrested on a visit to her native country in 2023 and sentenced to 6 ½ years in prison on charges she and RFE/RL said were unfounded. She was released in a prisoner exchange in August 2024.
In the United States, Oxygen Forensics netted lucrative contracts with government agencies including the Department of Homeland Security, which oversees the force that polices US borders and enforces immigration laws. The Secret Service bought the software for its National Computer Forensics Institute.
Internal sales charts shared with RFE/RL showed the company had contracts with dozens of agencies, federal and state, and numerous entities around the world.
According to court filings, after Russia launched its full-scale invasion of Ukraine in 2022, Oxygen began trying to conceal its Russian ownership, fearing the loss of US government contracts. The company set up a similarly named intermediary in Cyprus: Oxygen Cyprus.
Contrary to RFE/RL’s reporting, which found that Oxygen changed the name of its Russian entity to MKO-Systems in 2015, the Justice Department alleged the change occurred after 2022.
The five Russian owners, meanwhile, disappeared from Russian corporate filings, but prosecutors alleged that they continued to make company decisions, control payments, and retain oversight of corporate bank accounts.
Reiber, who could not be reached for comment, allegedly certified to the US government in 2022 and 2023 that Oxygen Forensics had no other owners, a key requirement for federal government contracts.
In November 2023, ownership of MKO-Systems was transferred to an obscure tech company called Prostranstvo IT. The company does not appear to disclose its current shareholders, and RFE/RL was unable to identify them.
Court Fight
In December 2023, Oxygen Forensics hired a Russian-speaking American man named Max Weissberg to help market the company, including producing promotional videos.
Weissberg was fired 22 months later, in October 2025, according to a lawsuit Oxygen filed against him seeking the return of two laptop computers and other digital files. The company accused Weissberg of “spreading false and defamatory statements that Oxygen Forensics was owned and controlled by the Russian Federal Security Service.”
Weissberg told RFE/RL that, in April 2024, he traveled to Moscow, where he met several of Oxygen’s Russian employees, including Davydov and Fyodorov.
While Davydov and other employees in Moscow were affable, Fyodorov was brusque and dour, he said.
“I don’t think he himself is FSB, but I think he definitely has friends and therefore he is untouchable,” Weissberg said. “Tons of swagger.”
Weissberg said he filed a whistle-blower complaint with the State Department last year, in October 2025, alleging Oxygen was misrepresenting its ownership.
The day after the Justice Department announced the criminal charges, on September 24, 2026, Weissberg said he met with investigators from the US Commerce Department, who asked him for more details about the company’s employees
They also told Weissberg an investigation into the company was opened initially the previous year, in October 2025, he said.
A Political Laptop
Well before Dimitrelos was hired to perform the data extraction using Oxygen’s software, Hunter Biden’s Apple laptop had been at the center of a white-hot scandal in US politics.
Biden, who was struggling with severe drug addiction, gave the damaged laptop to a repair shop in 2019, after which its data and content -- some of which was lurid or suggestive of shady business deals -- were shared with Republican lawyers and activists; several US news outlets published stories.
Major social media companies ended up restricting distribution of the stories, citing allegations that Russia might have tampered with the data.
Hunter Biden was charged in September 2023 with illegally possessing a gun while he was a drug addict -- a felony under US law -- and convicted by a federal jury nine months later.
During the court proceedings, an FBI agent testified that the agency had verified the authenticity of the laptop.
RFE/RL could not determine if the FBI used Oxygen’s software on the laptop.
