US businessman arrested as Russians hid behind a Cyprus holding company

US prosecutors have charged Lee Reiber, the American president and CEO of Alexandria, Virginia-based Oxygen Forensics, and Moscow-based Oleg Sergeyevich Davydov with conspiracy to commit wire fraud.

The allegation is straightforward and uncomfortable: after 2022 sanctions on Russia, the firm presented itself to US government buyers — including the Secret Service, other DHS components and the Department of War — as an independent American company whose software was developed in the United States.

Court papers say five Russian nationals in fact owned and controlled it through a Cyprus holding company, while the code was written and managed in Russia by a related Moscow firm that had sold similar tools to Russian security agencies.

Reiber was arrested in Idaho on 20 September 2026 and released on bond. Davydov was detained the same day at Heathrow. Both deny nothing yet in open court; they are presumed innocent.

The complaint

• Does not allege malware or unauthorised access.

• It does allege false ownership certifications and a deliberate effort to keep Russian names off public Virginia filings, while the same people continued to set pay, approve payments, and control bank accounts.

Court documents also describe a Virginia-bar lawyer who incorporated the company and acted as registered agent; he has not been charged.

Why this is a UBO-transparency case, not just a fraud case

Ultimate beneficial ownership is the point at which paper structures stop and real control begins.

• Here, the alleged structure was classic: a US operating company, a Cyprus holding company, Russian individuals behind it, and a public face who certified that no foreign person controlled the business.

• Government contractors in the United States are required to disclose ownership and foreign control.

• Those rules exist because software that extracts data from Secret Service devices is not a consumer app. If the complaint’s facts hold, the certifications were false, and the buyers did not know who actually owned the product they were putting on government systems.

• Cyprus is a lawful, widely used holding jurisdiction. That is not the lesson. The lesson is that a holding company is only as transparent as the people who fill in the forms and the buyers who verify them. Public corporate filings in Virginia omitted the Russians after 2022.

• SAM.gov and related contractor representations allegedly stated there was no immediate or highest-level owner. A later filing listed a “Turkish” president who, according to the affidavit, was one of the Russian shareholders using another passport. Paper trails that look clean at first glance are exactly where UBO risk lives.

Lessons that should already have been obvious

• First, self-certification is not due diligence.

  • A signed statement that “no foreign person has power to control directors or decisions” is only as good as the verification behind it.

  • Buyers of sensitive technology should treat Cyprus (and similar) holding companies as a prompt to ask who sits behind the HoldCo, who has signatory rights on the operating company’s accounts, and where the engineers actually sit — not as proof of independence.

• Second, timing matters.

  • The alleged concealment began immediately after expanded Russian sanctions in 2022. That is when ownership should have been re-checked, not waved through on the strength of an American CEO’s name on the door.

• Third, registered agents and incorporating lawyers sit at a choke point.

  • The complaint’s Co-Conspirator-6 is a reminder that the person who files the annual report can either surface beneficial owners or help bury them. Professional rules and anti-money-laundering obligations for lawyers and company-service providers exist for this reason. Scrutiny of that role is warranted even if no charge has been brought.

• Fourth, product origin and ownership are not the same question, but both matter for national-security procurement.

  • “Developed in the United States” and “no foreign ownership or control” were both allegedly false. Agencies that buy forensic tools should demand evidence of both: who owns the company and where the build environment and source control actually reside.

• Fifth, whistleblowers and open-source reporting often arrive before the indictment.

  • A former employee had already alleged Russian control.

  • That does not prove the criminal case. It does show that waiting for a DOJ complaint is a late way to discover UBO risk.

None of this requires assuming guilt. It does require treating beneficial-ownership rules as operational security, not paperwork. When the customer is the Secret Service, a Cyprus HoldCo plus an American front-man is not a technicality. It is the risk the transparency rules were written to catch.

Comsure analysis

The announced case is about false declarations, not a charged sanctions breach. Treat those as different legal things. Do not collapse them.

What they have actually been charged with

Reiber and Davydov are charged with conspiracy to commit wire fraud. The core allegation is that they lied to US government buyers — in contractor certifications, corporate filings and direct statements — so the company could win and keep federal contracts.

The alleged lies are:

• No foreign ownership or control

• No immediate or highest-level owner

• No foreign person with the power to appoint directors or direct decisions

• Software developed in the United States / no Russians in the development environment / no presence in a “restricted jurisdiction”

That is procurement fraud and false representation. It is not an OFAC or IEEPA count on the face of the complaint as announced.

• Official source: https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

Where sanctions sit in the story

Sanctions are the motive and timing, not the charged offence.

• Prosecutors say the concealment started after the US expanded sanctions on Russia in early 2022. Russian names were stripped from Virginia filings. Reiber was put forward as the American face. The related Moscow company changed its name from Oxygen Software to MKO Systems.

• An email in the affidavit has Reiber writing that because of “US sanction to any Russian, now along with our US Commerce scrutiny on exports,” the US company must stop certain reimbursements.

• That is evidence they knew sanctions and export scrutiny made Russian ownership and a Russian development team commercially toxic.

• It is not, by itself, a finding that they dealt with a blocked person or moved controlled goods to Russia in violation of OFAC or the Export Administration Regulations.

Important gap:

• The public materials do not say Davydov or the other four shareholders were SDN-listed or otherwise blocked. Being a Russian national after 2022 is not automatically an OFAC violation.

• Selling software to the US government from a company with Russian UBOs is also, without more, a classic “export to Russia” or “dealing with a sanctioned party” case.

What is not charged (so far)

There is no announced count for:

• Violating IEEPA / OFAC sanctions

• Exporting controlled items to Russia

• Causing a US person to deal with a blocked person

2024 Virginia case (Eleview International)

• A different 2024 Virginia case (Eleview International) was an export-control prosecution. That is not this case. Do not mix them.

• On 4 November 2024 the US Attorney’s Office for the Eastern District of Virginia charged Eleview International Inc. (a Chantilly / Fairfax-area freight consolidator and forwarder), its owner-president-CEO Oleg Nayandin (54, Fairfax) and operations manager Vitaliy Borisenko (39, Vienna) with conspiracy to violate the Export Control Reform Act.

• Prosecutors said that from about February/March 2022 to June 2023 — after the post-invasion export restrictions on Russia — they used three transhipment routes to move US goods and technology to Russian end users while naming false customers in Turkey, Finland and Kazakhstan.

• Russian buyers ordered through Eleview’s e-commerce site; US retailers shipped to Eleview’s Virginia warehouse; packages were then forwarded onward. Some shipments carried Russian postal tracking labels. Items included telecommunications equipment and other dual-use / “high priority” electronics BIS linked to Russian weapons, including components of the type found on Russian loitering munitions.

• Approximate values cited: about $1.48m via Turkey (alleged true destination a Russian telecoms firm that supplied the Russian government, including the FSB), about $3.45m via Finland, and about $1.47m via Kazakhstan.

• They were sentenced on 13 February 2026:

  • Nayandin three years’ imprisonment;

  • Borisenko one year;

  • Eleview $125,000 fine and three years’ probation with compliance reporting and staff export-control training. BIS and HSI were investigated.

Sources

• Charges (4 Nov 2024): https://www.justice.gov/usao-edva/pr/virginia-company-and-two-senior-executives-charged-illegally-exporting-millions
  Sentencing (13 Feb 2026): https://www.justice.gov/usao-edva/pr/virginia-company-owner-and-senior-employee-sentenced-illegally-exporting-millions
  Yle (Finland route): https://yle.fi/a/74-20122594
  CourtListener docket: https://www.courtlistener.com/docket/69344285/united-states-v-eleview-international-inc/

The live sanctions / export-control risk

Two things keep a sanctions/export overlay alive even though it is not the charge:

1. BIS is investigating. The Commerce Department’s Bureau of Industry and Security is on the case with DCIS. BIS owns export controls, not wire fraud. That investigation could later produce EAR or related charges. It has not yet, on the public record.
   https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and
   Trade Law Daily summary: https://tradelawdaily.com/article/2026/09/25/bis-investigating-people-charged-with-concealing-federal-contractors-russian-ownership-2609240059

2. Facts that could become export-control issues if proved: software written and managed in Russia; a nominal US “build” step allegedly created so they could claim US origin; money flowing US company → Cyprus HoldCo → Russian shareholders; a sister company in Russia selling related tools to the FSB and other Russian agencies. Those facts matter for origin, deemed exports, foreign-person access to technology, and contractor foreign-ownership rules. They are not the same as an OFAC breach.

Plain conclusion

• Charged conduct: false declarations to obtain US government money.

• Sanctions: the reason they allegedly hid the UBOs, not the statute they have been charged under.

• Open question: whether BIS later adds export-control counts. That has not happened in the materials published so far.

A UBO/sanctions-compliance lesson, the accurate framing is:

• Post-2022 Russia risk made honest ownership disclosure commercially fatal, so they allegedly lied on contractor forms.

• That is how sanctions regimes often bite in practice — through disclosure and eligibility rules — even when nobody is on the SDN list.

Primary sources

• DOJ announcement: https://www.justice.gov/usao-cdca/pr/tech-ceo-russian-national-arrested-complaint-alleging-they-hid-russian-ownership-and

• NYT: https://www.nytimes.com/2026/09/25/world/europe/russia-software-arrest.html

• OCCRP: https://www.occrp.org/en/news/us-charges-tech-ceo-russian-over-hidden-ownership

• GIR (lawyer scrutiny): https://globalinvestigationsreview.com/just-sanctions/article/doj-alleges-us-software-company-hid-russian-ownership

• Complaint PDF via CourtListener: https://storage.courtlistener.com/recap/gov.uscourts.idd.60763/gov.uscourts.idd.60763.1.0_1.pdf