How Much Did the U.S. Government Spend on Oxygen Forensics?

Published on September 29, 2026 | Written by Alec Pow
This article was researched using 14 sources. See our methodology and corrections policy.

At least $3.48 million in documented federal obligations and payments can be tied to Oxygen Forensics software purchases since 2015. That figure combines $2,010,876 in direct prime federal obligations to Oxygen Forensics Inc. with $1,469,400 obligated through a separate Secret Service reseller contract for Oxygen software. It is a documented floor, not a complete government-wide total.

The distinction became more important after the Justice Department announced criminal charges on September 23, 2026. Prosecutors allege that Oxygen’s chief executive and a Russian national concealed Russian ownership, control, and software development while selling forensic software to U.S. agencies. The complaint does not allege malicious code or unauthorized access to customer systems or data. The allegations have not been proven in court, and the defendants are presumed innocent.

Article Highlights

• Direct prime federal obligations to Oxygen Forensics total $2,010,876 (at $30 per hour, earning that amount would take about 32 years of full-time work, before taxes) across 54 awards in the available recipient history.
• A separate Secret Service NCFI contract through reseller Active Security Consulting has $1,469,400 obligated for Oxygen software.
• Adding those non-overlapping records produces a documented floor of $3,480,276.
• The NCFI contract has a $12 million ceiling, but only about 12.2% of that ceiling has been obligated.
• The federal complaint says government customers awarded contracts and made purchases totaling more than $2 million after June 7, 2022. That amount overlaps the spending records and must not be added again.
• Prosecutors do not allege that Oxygen software contained malicious code or was used for unauthorized access.

How Much Did the U.S. Government Spend on Oxygen Forensics?

The cleanest reconstruction starts with direct federal awards. Federal-contract data compiled from USAspending records show Oxygen Forensics Inc. receiving $2,010,876 in obligations across 54 prime awards. The record reaches back to 2015 and includes buyers within Homeland Security, Justice, State, Treasury, and other departments.

That direct-recipient total misses a major purchase made through a reseller. The Secret Service’s National Computer Forensics Institute awarded Active Security Consulting a five-year vehicle for Oxygen software. Federal contract data show $1,469,400 (about 24 years of full-time work at $30 per hour) obligated under that separate vehicle. Because the prime recipient is Active Security Consulting rather than Oxygen Forensics, those obligations are not inside Oxygen’s $2,010,876 recipient total.

Documented spending measure	Amount	How to read it
Direct prime obligations to Oxygen	$2,010,876	Federal contracts recorded under Oxygen’s recipient identity
NCFI Oxygen contract through reseller	$1,469,400	Separate Secret Service obligations to Active Security Consulting
Reconstructed documented floor	$3,480,276	Direct obligations plus the non-overlapping reseller vehicle
NCFI contract ceiling	$12,000,000	Maximum ordering capacity, not money already spent
Complaint’s post-June 2022 figure	More than $2,000,000	Overlaps records above, so it cannot be added again

The worked total is $2,010,876 + $1,469,400 = $3,480,276. Federal obligations are legal commitments to pay, not always the same thing as Treasury cash outlays. The NCFI affidavit language uses payments for two years, while the direct-recipient total uses obligations. The $3.48 million number is best described as a documented federal spending and commitment floor rather than an audited cash-outflow total.

The $12 Million Ceiling

The number most likely to be misread is $12 million (about 192 years of full-time work at $30 per hour). In September 2024, the Secret Service awarded Active Security Consulting an indefinite-delivery contract to provide Oxygen Forensic Detective software to the National Computer Forensics Institute. The NCFI contract record shows a five-year ordering period, a $12 million vehicle ceiling, an individual order limit of $2.8 million, and $1,469,400 obligated to date.

Only 12.245% of the ceiling has been obligated because $1,469,400 divided by $12 million equals 0.12245. Put another way, the ceiling is about 8.17 times the amount obligated so far. Calling the contract a $12 million purchase would overstate the documented obligation by more than $10.53 million.

The ceiling is not a quoted license price. The contract covers Oxygen Forensic Detective with two years of software maintenance and 78 pieces of NCFI computer hardware. Actual task orders determine what is bought, so a ceiling does not prove the agency will use all of it.

This is the hidden accounting issue in the story. Contract ceiling, potential value, obligation, payment, and vendor revenue are different numbers. Mixing them can turn a roughly $1.47 million obligated contract into a misleading $12 million headline.

Where the Money Went

The direct award record is spread across agencies and years. Immigration and Customs Enforcement bought Oxygen Forensic Detective in September 2022 under a $127,443 purchase order. The award was funded from ICE operations and support and received one bid under simplified acquisition procedures.

The State Department provides two recent examples. A contract for Oxygen Forensics Detective licenses supporting CTI and CIF has $119,058.40 obligated and a potential value of $180,664.20. A separate U.S. Embassy Zagreb purchase dated August 28, 2026 records $49,999.76 for Oxygen software.

The Drug Enforcement Administration also made smaller direct purchases. Its August 2025 order for Oxygen forensic software was worth $26,941. These examples are already part of the $2,010,876 direct-prime total. They show how a federal software footprint can be assembled from many modest orders rather than one giant contract.

The Secret Service Deal

The criminal affidavit gives unusually specific cash-flow numbers for the NCFI contract. It states that NCFI paid approximately $744,000 under the contract in 2024 and approximately $725,400 in 2025. Those payments total $1,469,400, matching the federal contract obligation figure. The criminal complaint and affidavit says Oxygen US then received corresponding deposits of $706,984 and $689,309.

Those two Oxygen deposits total $1,396,293. That equals about 95.0% of NCFI’s $1,469,400 in payments during the two stated years. The numerical gap is $73,107. Public records do not establish that the gap was reseller profit. Taxes, timing, hardware, contract costs, or other accounting items could affect the difference.

The NCFI procurement was also larger than one software brand. The Secret Service sought six categories of forensic software for training programs. Its forensics software solicitation named Oxygen Forensic Detective alongside Cyber Triage, CellHawk, TRM Forensics, Amped FIVE, and Authenticate. Oxygen was one component in a wider digital-forensics training stack.

The procurement sheet projected 156 Oxygen packages in each of the first three years and 208 in each of years four and five, with two years of maintenance per package. That forecast does not reveal the actual unit price because the public pricing sheet left bidder prices blank and task-order quantities can differ from projections.

What Prosecutors Allege

The Justice Department announced arrests of Oxygen Forensics CEO Lee Reiber and Russian national Oleg Sergeyevich Davydov on September 23, 2026. The DOJ’s criminal allegations charge the two men by complaint with conspiracy to commit wire fraud. Prosecutors allege that five Russian nationals owned and controlled Oxygen Forensics through a Cyprus company while the forensic software was developed by a team primarily in Russia.

The affidavit says affected government customers included the Secret Service and NCFI, Homeland Security Investigations, the DHS Office of Inspector General, and the Defense Department. It alleges that contracts and purchases by those customers totaled more than $2 million after June 7, 2022. That amount overlaps the federal spending reconstruction above. Adding it to $3.48 million would double count some of the same purchases.

The case needs a precise security description. DOJ expressly says the complaint does not allege that the software contained malicious code and does not allege that it was used to gain unauthorized access to any customer’s computer systems or data. Calling Oxygen Forensics a proven Russian Trojan horse would go beyond the government’s case.

The complaint is an allegation, not a conviction. Reiber and Davydov are presumed innocent unless proven guilty. The money figures can be documented independently from federal procurement records, while the ownership, control, and development claims remain allegations before the court.

The Ownership Gap

The procurement-control timeline is as striking as the dollar amount. An independent review of the complaint calculated that the ownership certification in the NCFI award file was 327 days old when the Secret Service signed the $12 million-ceiling contract. The 327-day certification analysis traces the October 27, 2023 self-certification to the September 18, 2024 award.

According to the complaint, Reiber had certified that the company had no immediate or highest-level owner. Prosecutors allege that five Russian nationals actually owned and controlled the Cyprus parent and, through it, the U.S. company. The same analysis notes that later federal award records described the supplier inconsistently, with some actions labeling it U.S.-owned and others foreign-owned and U.S.-incorporated.

The affidavit adds another financial trail that should not be confused with federal purchasing. It alleges that between June 2022 and January 2026 Oxygen US sent at least 128 wire transfers totaling approximately $19,052,983 to Oxygen Cyprus. The invoices characterized the transfers as royalties or licensing fees. That $19.05 million figure concerns Oxygen’s broader company revenue flow, not U.S. government spending, so it does not belong in the $3.48 million taxpayer-spending calculation.

The federal spending record and the alleged corporate money flow are not the same ledger.

Competing Forensic Tools

Oxygen Forensics was not the federal government’s only mobile-forensics supplier. ICE awarded a 2026 purchase order for Cellebrite products and services worth $948,620.64. That one ICE order is about 65% of the $1.469 million currently obligated under the NCFI Oxygen reseller vehicle, although the scopes, products, quantities, and periods are different.

The comparison matters because removing or replacing one forensic product does not eliminate an agency’s digital-evidence needs. Mobile extraction, cloud collection, analytics, computer forensics, and evidence review are often handled by several tools. Government laboratories can hold overlapping licenses because device support and acquisition methods differ. The cost of hard drive data recovery also measures a different service entirely and should not be substituted for forensic-software licensing.

The NCFI solicitation itself confirms a multi-vendor model. It requested six software categories for training, with graduates expected to take licensed tools back to their jurisdictions. Replacing one product can create more than a new license invoice because training material, workflows, examiner familiarity, and supported evidence formats may also change.

No public record reviewed here establishes a government-wide replacement cost for Oxygen. A future migration could be cheap if agencies already own sufficient alternatives, or expensive if they need new licenses, training, and validation work. Those costs should not be added to past Oxygen spending before actual contracts appear.

What the Records Miss

The $3.48 million figure is deliberately a floor. Direct prime awards are easy to connect to Oxygen because the company is named as the recipient. Reseller contracts are harder. The NCFI vehicle appears under Active Security Consulting, which means a recipient-only search for Oxygen does not capture it. Other indirect purchases can sit under distributors, integrators, purchase cards, or broader contract vehicles.

The affidavit supports that limitation. It says Oxygen software was sold directly and through resellers to the named government customers. It also says the Secret Service awarded seven contracts between 2016 and 2024 either directly or through resellers. The federal recipient history alone cannot reconstruct every indirect purchase unless the underlying contract description names Oxygen.

State, local, tribal, and territorial agencies create another boundary. NCFI equips trainees with forensic software under a federal program, but separate purchases later made by local agencies do not belong in a federal spending total. Federally funded grants can require separate tracing.

The same care applies to future response costs. Agencies may review software inventories, preserve evidence, replace licenses, or change procurement controls, but there is no public dollar total for those actions yet. Costs such as cyber liability insurance belong to a different market and should not be treated as a proxy for federal remediation.

How to Read the Total

The strongest answer today is at least $3.48 million in documented federal obligations and payments tied to Oxygen Forensics software. That combines the direct Oxygen prime-award history with the separately documented NCFI reseller obligations. It is broad enough to correct the mistake of counting only awards under Oxygen’s name and narrow enough to avoid treating unused contract ceilings as spending.

Counts toward the documented floor

• $2,010,876 in direct federal prime obligations recorded for Oxygen Forensics.
• $1,469,400 obligated under the separate NCFI Oxygen software vehicle held by Active Security Consulting.

Does not get added to the floor

• The unused portion of the $12 million NCFI ceiling.
• The complaint’s more than $2 million post-June 2022 figure because those purchases overlap the same contract record.
• The alleged $19.05 million in company transfers to Cyprus because that is company revenue movement, not federal spending.
• Possible future replacement, investigation, training, or migration costs that have not been contracted.

The number can rise if more reseller awards are identified. Until then, $3,480,276 is a reproducible public-record floor, not a claim that every federal purchase has been captured.

Answers to Common Questions

How much did the U.S. government spend on Oxygen Forensics?

Public records support a floor of at least $3,480,276 in direct federal obligations and separately documented NCFI reseller payments tied to Oxygen software.

Did the government spend $12 million on Oxygen Forensics?

No. The NCFI contract has a $12 million ceiling, but only $1,469,400 has been obligated under that vehicle in the records reviewed.

Which agencies bought Oxygen software?

Records identify buyers that include the Secret Service, ICE and Homeland Security Investigations, the DHS Office of Inspector General, the Defense Department, the State Department, and the DEA, among others.

Did DOJ say Oxygen Forensics was malware?

No. DOJ says the complaint does not allege malicious code and does not allege unauthorized access to customer systems or data.

Is the $3.48 million figure complete?

No. It is a documented floor. Additional reseller or indirect federal purchases may not appear under Oxygen Forensics’ own recipient record.