UNITED STATES DISTRICT COURT 

SOUTHERN DISTRICT OF OHIO 

WESTERN DIVISION 

FILED 

TIME 'f: Z'tPM 

JAN 1 Y 2018 

RICHARD w:-NAGEL 

Clerk of Court 

CINCINNATI, OHIO 

IN RE APPLICATION OF THE UNITED 

STATES OF AMERICA FOR AN ORDER 

AUTHORIZING THE INSTALLATION 

AND USE OF PEN REGISTERS AND 

TRAP AND TRACE DEVICES 

CASE NO. t I 1 8 M J - 0 3 '7 

APPLICATION 

(UNDER SEAL) 

The United States of America, moving by and through AUSA Karl P. Kadon, III, its 

undersigned counsel, respectfully submits under seal this ex parte Application for an order 

pursuant to 18 U.S.C §§ 3122 and 3123, authorizing the installation and use of pen registers and 

trap and trace devices ("pen-trap devices") to record, decode, and/or capture dialing, routing, 

addressing, and signaling information associated with each communication to or from the cellular 

telephone number 513-238-0946 (Target Telephone), described in Attachment A. In support of 

this Application, the United States asserts: 

1. This is an Application, made under 18 U.S.C. § 3122(a)(l), for an order under 18 

U.S.C. § 3123 authorizing the installation and use of a pen register and a trap and trace device. 

2. Such an Application must include three elements: (I) "the identity of the attorney 

for the Government or the State law enforcement or investigative officer making the Application" ; 

(2) "the identity of the law enforcement agency conducting the investigation" ; and (3) " a 

certification by the applicant that the information likely to be obtained is relevant to an ongoing 

criminal investigation being conducted by that agency." 18 U.S.C. § 3122(b). 

3. The undersigned applicant is an "attorney for the government" as defined in Rule 

l(b)(l) of the Federal Rules of Criminal Procedure. 

4. The law enforcement agency conducting the investigation is the Federal Bureau of 

Investigation (FBI). 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 1 of 13 PAGEID #: 1
5. The applicant hereby certifies that the information likely to be obtained by the 

requested pen-trap devices is relevant to an ongoing criminal investigation being conducted by the 

FBI into SHAUN LILLY, STEFFEN ROBERSON, and other as-yet- unknown individuals, in 

connection with possible violations of Title 21 , United States Code, Sections 84l(a)(l) and 846. 

6. The applicant understands that the FBI and the United States Attorney's Office are 

directed to comply with the limitations set forth in 18 U.S.C. § 3123(c). 

7. This Court is a "court of competent jurisdiction" under 18 U.S.C. § 3 l 22(a)(2) 

because it "has jurisdiction over the offense being investigated," 18 U .S.C. § 3 I 27(2)(A)(i). 

8. Other than the three elements described above, federal law does not require that an 

Application for an order authorizing the installation and use of a pen register and a trap and trace 

device specify any facts. The following additional information is provided to demonstrate that the 

order requested falls within this Court's authority to authorize the installation and use of a pen 

register or trap and trace device under 18 U.S.C. § 3123(a)(l). 

9. A "pen register" is "a device or process which records or decodes dialing, routing, 

addressing, or signaling information transmitted by an instrument or facility from which a wire or 

electronic communication is transmitted." 18 U .S.C. § 3127(3). A "trap and trace device" is "a 

device or process which captures the incoming electronic or other impulses which identify the 

originating number or other dialing, routing, addressing, and signaling information reasonably 

likely to identify the source of a wire or electronic communication." 18 U.S.C. § 3127(4). 

THE RELEVANT FACTS 

10. Since August 2012, the Cincinnati Police Department ("CPD"), along with the 

Federal Bureau of Investigation Cincinnati Division ("FBI"), the Drug Enforcement 

Administration Resident Agency ("DEA") and the Bureau of Alcohol, Tobacco, and Firearm 

Cincinnati Resident Agency ("ATF") have conducted an investigation into the heroin trafficking 

activities of STEFFEN ROBERSON aka "WORM" DTO, SHAUN LILLY, and others. The 

2 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 2 of 13 PAGEID #: 2
"WORM" OTO has been operating throughout the city of Cincinnati and is believed to have close 

ties with large scale distributors operating in Atlanta, Georgia, which serves as a main source of 

supply to the "WORM" OTO. While the investigation into the "WORM" OTO had been extensive, 

in December 2017, DEA and CPD ceased all investigative activity and turned investigative 

responsibilities over to FBI. 

11. Confidential Human Source l ("CHS I") has been working for the Cincinnati 

Police Department since 2010 and has a criminal history to include narcotics trafficking and 

weapons related offenses. CHS 1 has been deemed reliable by the FBI and CPD based on the 

corroborated reliable information and intelligence CHS 1 has been able to provide during this and 

other narcotics related investigations. For instance, November 7, 2017, CHS 1 reported to agents 

that "SHAUN" works in conjunction with "WORM" and travels frequently to Atlanta, Georgia 

with others in a vehicle to meet with a source of supply, to purchase unknown quantities of heroin, 

and transport the unknown quantities of heroin back to Cincinnati, Ohio. CHS 1 provided agents 

with the primary contact telephone number for "SHAUN" 513-238-0946 (hereinafter Target 

Telephone) a T-Mobile cellular service provider telephone number. CHS 1 provided information 

that "SHAUN" owns multi-unit rental property apartments at the address of 3160-3172 McHenry 

A venue in Cincinnati, Ohio. The property records check for the Hamilton County Ohio Auditors 

office revealed the information that SHAUN LILLY was the registered property owner for the 

multi-unit apartment buildings at 3160-3172 McHenry Avenue. A telephone records check of the 

Target Telephone revealed the information of the subscriber for the T-Mobile account was 

SHAUN LILLY. The telephone records check also revealed the Target Telephone as having 

frequent contacts with targets of two active FBI cases involving narcotics trafficking and money 

laundering offenses. 

12. On November 17, 2017, CHS 1 contacted agents and provided information that "SHAUN" 

offered to sell CHS 1 one ounce quantities of heroin for a purchase price of $3,000.00 each and to 

3 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 3 of 13 PAGEID #: 3
contact him on the Target Telephone when ready to conduct the transaction. "SHAUN" informed 

CHS 1 he would be ready meet at his rental properties on McHenry Avenue to conduct the 

transactions after he returned from taking a trip to Atlanta, Georgia in a few days' time. 

13. On December 31 , 2017, CHS 1 again contacted the case agent and stated that the 

same previously-referenced "SHAUN", acquired unknown quantities of heroin after recently 

traveling to Atlanta, Georgia and again offered to sell ounce quantities to CHS 1 for the purchase 

price of $3,000.00 per ounce in person while attending a social function. 

14. On January 4, 2018, Agents also gathered intelligence from a second 

Confidential Human Source (hereinafter "CHS 2") a cooperating defendant who has been working 

for the State of Ohio Bureau of Criminal Investigations (BCI) since 2015, provided intelligence on 

members of this criminal organization .. CHS 2 has provided reliable information during this and 

other narcotics related investigations. CHS 2's reliability has been determined by the BCI based 

on CHS 2's previous reliable information reporting on narcotics and violent crimes, including 

information provided to the FBI from CHS 2. Information provided by CHS 2 regarding subjects, 

vehicles driven by subjects, and phone numbers of subjects have all been corroborated through, 

e.g., toll analysis of phones, surveillance of subjects at specific locations, or physical observations 

of subjects at certain residences and or in specific vehicles. CHS 2 contacted agents with 

information that "WORM" and UM "CHEWY" was involved in money laundering activities with 

other unidentified females utilizing a residence to store quantities of U.S. currency and heroin. 

CHS 2 observed UM "CHEWY" provide an unknown female with approximately $15,000.00 in 

U.S. currency at the storage residence. CHS 2 was a passenger in a rental vehicle and traveled to 

Atlanta, Georgia with "CHEWY" and another unknown male driver. Upon arriving in Atlanta, 

Georgia CHS 2 was taken to a condominium "WORM" owned and who was present at, to provide 

an opinion on the quality of the heroin before an agreement was reached by the group to purchase 

the heroin based on CHS 2's opinion. 

4 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 4 of 13 PAGEID #: 4
15. Based on my training and experience, and the aforementioned facts and reporting, 

I believe there is probable cause to show that SHAUN LILLY is using the Target Telephone to 

commit federal narcotics offenses and that the information requested will assist the FBI in 

identifying co-conspirators and additional cellular devices owned and operated by the targeted 

subjects. 

16. The conduct being investigated involves use of the cellular telephone number 

described in Attachment A. To further the investigation, investigators need to obtain the dialing, 

routing, addressing, and signaling information associated with communications sent to or from 

that cellular telephone number. 

17. The pen-trap devices sought by this Application will record, decode, and/or capture 

dialing, routing, addressing, and signaling information associated with each communication to or 

from the cellular telephone number described in Attachment A, including the date, time, and 

duration of the communication, and those items listed in Attachment B, without geographic limit. 

18. In the traditional telephone context, pen registers captured the destination phone 

numbers of outgoing calls, while trap and trace devices captured the phone numbers of incoming 

calls. Similar principles apply to other kinds of wire and electronic communications, as described 

below. 

19. A cellular telephone, or cell phone, is a mobile device that can transmit and receive 

both wire and electronic communications. Individuals using cellular telephones contract with 

cellular service providers, who maintain antenna towers covering specific geographic areas. In 

order to transmit or receive calls and data, a cellular telephone must send a radio signal to an 

antenna tower that, in turn, is connected to a cellular service provider's network. A cellular 

telephone connected to a cellular service provider's network can thus act much like a traditional 

landline telephone and a computer. This Application seeks both traditional telephone calling data 

5 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 5 of 13 PAGEID #: 5
(i.e., telephone numbers dialed and dialing the target device), as well as data related to the dialing, 

routing, addressing and signaling of electronic communications sent to and from the target device. 

20. In addition to a unique telephone number, each cellular telephone has one or more 

unique identifiers embedded inside it. Depending upon the cellular network and the device, the 

embedded unique identifiers for a cellular telephone could take several different forms, including 

an Electronic Serial Number ("ESN"), a Mobile Electronic Identity Number ("MEID"), a Mobile 

Identification Number ("MIN"), a Subscriber Identity Module ("SIM"), an International Mobile 

Subscriber Identifier ("IMSI"), a Mobile Subscriber Integrated Services Digital Network Number 

("MSISDN"), or an International Mobile Station Equipment Identity ("IMEi"). When a cellular 

telephone connects to a cellular antenna or tower, it reveals its embedded unique identifiers to the 

cellular antenna or tower, and the cellular antenna or tower receives and forwards those identifiers 

to the core network as a matter of course. The unique identifiers-as transmitted from a cellular 

telephone to a cellular network- are similar to telephone numbers in that they are used by the 

cellular provider to identify, authenticate, and/or route the communications. They can be recorded 

by pen-trap devices and indicate the identity of the cellular telephone device making the 

communication without revealing the communication's content. 

21 . In addition, a list of incoming and outgoing telephone numbers is generated when 

a cellular telephone is used to make or receive calls, or to send or receive text messages (which 

may include photographs, videos, and other data). These telephone numbers can be recorded by 

pen-trap devices and then used to identify the parties to a communication without revealing the 

communication's contents. 

ELECTRONIC COMMUNICATIONS 

24. The Internet is a global network of computers and other devices. On the Internet, 

data transferred between devices is not sent as a continuous stream, but rather it is split into discrete 

packets. Generally, a single communication is sent as a series of data packets. When the packets 

6 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 6 of 13 PAGEID #: 6
reach their destination, the receiving device reassembles them into the complete communication. 

Each packet has two parts: a header with routing and control information, and a payload, which 

generally contains user data. The header contains non-content information such as the packet's 

source and destination Internet Protocol (IP) addresses 1, source and destination port numbers2, 

transport protocol3, flow label4 (when 1Pv6 applies), and the packet's size 5. The payload usually 

includes the content of the transmitted communication - for example, part of the text of an e-mail 

message or the data that makes up part of an electronic image. 

25. Cellular phones can connect to the Internet via the cellular network. They can then 

be used to browse the World Wide Web, send e-mail messages, and engage in other forms of 

electronic communications, just like desktop computers. When connecting through the cellular 

network, Internet communications sent and received by a cellular phone will contain some of the 

same unique identifiers that identify cellular voice communications, such as an ESN, MEID, MIN, 

SIM, IMSI, MSISDN, or IMEi. Internet communications sent to and from a cellular phone also 

1 A numerical label that identifies the source or terminating device on an IP network 

transmitting an individual packet associated with a communication. 

2 Port numbers of the IP packet uniquely identify different applications or processes 

running on a single device (the source or destination device) and enable the devices to share a 

single physical connection to a network. This parameter is also used by communication providers 

for routing of IP packets when utilizing Network Address Translation (NAT), which is common 

among cellular telephone providers. The source and destination ports are numerical labels that 

identify the endpoints at the source and destination devices on an IP network transmitting an 

individual packet associated with a communication. When combined with the source and 

destination IP addresses, this routing information identifies the source transmitting an IP packet 

and the destination receiving the IP packet. 3 The transport protocol defines the protocol used in the data portion of the IP packet. 

One example is the Transport Control Protocol, or TCP, which is one of the core protocols of the 

Internet Protocol suite. TCP provides reliable, ordered and error-checked delivery of a stream of 

octets between programs running on computers connected to a local area network, intranet or the 

public Internet. 

4 The field in the 1Pv6 header that is used by a source to label packets of a flow to avoid 

disruption during reassembly. This can facilitate such processes as streaming online video or audio 

feeds. The flow label can be used to indicate to routers and switches with multiple outbound paths 

that the listed packets should stay on the same path so that they will not be reordered. 5 The field that defines the entire packet size, including header and data, in bytes. 

7 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 7 of 13 PAGEID #: 7
contain the header information referenced above in each data packet, such as the source and 

destination IP addresses and the source and destination port numbers associated with that cellular 

phone at the specific time of the communication. Each of these unique identifiers can be used to 

identify devices that are party to a communication without revealing the communication's 

contents. The IP addresses and port numbers recorded in the headers of data packets also are 

readily available to the cellular service provider in each and every data packet (if they were not, 

the packets could not be routed to and from their destinations), and can easily be extracted by a 

pen register and trap and trace device. 

26. On the Internet, IP addresses and port numbers function much like telephone 

numbers and area codes - often both are necessary to route a communication. Devices directly 

connected to the Internet are identified by a unique IP address. This number is used to route 

information between devices. Generally, when one device requests information from a second 

device, the requesting device specifies its own IP address so that the responding device knows 

where to send its response. Both the IP address of the requesting device (the source IP address) 

and the IP address of the receiving device (the destination IP address) are included in specific fields 

within the header of each packet of data sent over the Internet. Source and destination port 

numbers are also included in specific fields within the headers of data packets. Sometimes these 

port numbers identify the type of service that is connected with a communication (for example 

email or web-browsing), but often they identify a specific device on a private network. In either 

case, port numbers are used to route data packets either to a specific device or a specific process 

running on a device. Thus, in both cases, port numbers are used by computers to route data packets 

to their final destinations. 

27. The headers of data packets also contain other dialing, routing, addressing and 

signaling information. This data includes the transport protocol used (there are several different 

transport protocols that provide transport of data over networks); the flow label (which helps 

8 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 8 of 13 PAGEID #: 8
control the path and order of transmission of packets in certain circumstances - for example the 

packets that make up streaming video that must be placed in a certain order once received); and 

the packet size (used to identify the size of each data packet). 

28. Because they are all used to facilitate the routing and transfer of data, and because 

they do not contain the content of communications, the United States requests that this Court order 

Sprint to either produce, or assist the United States in obtaining through the installation of a Pen 

Trap device, the IP addresses, port numbers, transport protocol, flow label and packet size of each 

data packet sent to and from the target device. See 18 U.S.C. §§ 3122 and 3123. 

29. The United States further requests that the Court order Sprint to provide other data 

related to each data packet sent over the provider's network. These data fields are commonly 

provided by cellular telephone providers pursuant to industry standards adopted under the 

Communications Assistance for Law Enforcement Act (CALEA). See 47 U.S.C. § 1006. They 

include: the Case Identification (or Case ID), which is a unique identifier used by law enforcement 

and the provider to identify the case to which the data pertains; the Intercept Access Point System 

Identification (IAP System ID), which identifies the network equipment responsible for isolating 

the targeted information; the Timestamp, which identifies the date and time that the event was 

detected; and the Correlation Number, which provides a unique identifier for the call data that is 

used to correlate the communication identifying information with the communication content. 

GOVERNMENT REQUESTS 

30. For the reasons stated above, the United States requests that the Court enter an 

Order authorizing the installation and use of pen-trap devices to record, decode, and/or capture the 

dialing, routing, addressing, and signaling information described above for each communication 

to or from the cellular telephone number described in Attachment A, to include the date, time, and 

duration of the communication, and those items listed in Attachment B, without geographic limit. 

9 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 9 of 13 PAGEID #: 9
The United States does not request and does not seek to obtain the contents of any communications, 

as defined in 18 U.S.C. § 2510(8). 

31. Based on the specific and articulable facts set forth above, pursuant to Title 18, 

United States Code, Sections 2703(c)(l)(B), 2703{c)(2) and 2703(d), the United States requests 

that Sprint be ordered to supply subscriber information (including the names and addresses of the 

subscriber, whether listed or unlisted, billing information, payment information, subscriber date of 

birth, subscriber driver license number, subscriber social security number, equipment information, 

shipment information, call detail records, information related to calls made via direct connect 

features, calls to destination search (or " reverse dumps"), and periods of telephone activation) for 

all numbers dialed or connections made to and from the cellular telephone number described in 

Attachment A captured by the pen register or trap and trace devices on the cellular telephone 

number described in Attachment A. 

32. The United States further requests that the Court authorize the foregoing installation 

and use for a period of sixty (60) days from the date of the Court's Order, pursuant to 18 U.S.C. § 

3123(c){l). 

33. The United States further requests, pursuant to 18 U.S.C. §§ 3123(b )(2) and 

3124( a)-(b ), that the Court order Sprint and any other person or entity providing wire or electronic 

communication service in the United States whose assistance may facilitate execution ofthis Order 

to furnish, upon service of the Order, information, facilities, and technical assistance necessary to 

install the pen-trap devices, including installation and operation of the pen-trap devices 

unobtrusively and with minimum disruption of normal service. Any entity providing such 

assistance shall be reasonably compensated by the FBI, pursuant to 18 U.S.C. § 3124(c), for 

reasonable expenses incurred in providing facilities and assistance in furtherance of this Order. 

34. If Sprint, or any other relevant provider of electronic communication service to the 

public, cannot comply with this Court's Order to install the pen-trap devices, the United States 

10 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 10 of 13 PAGEID #: 10
requests authorization to install and use its own pen register and trap and trace devices on the data 

network of Sprint, or any other relevant provider of electronic communication service to the public, 

pursuant to 18 U.S.C. § 3 l 23(a)(3)(A). 

35. The United States further requests, pursuant to 18 U.S.C. §§ 3123(b)(2) and 

3124(a)-(b), that the Court order Sprint and any other person or entity providing wire or electronic 

communication service in the United States whose assistance may facilitate execution of this 

Order, to furnish immediate technical assistance to the FBI to accomplish the interception of all of 

the dialing, routing, addressing, and signaling information for all data packets associated with 

each communication to or from the target device, including the date, time and duration of the 

communication; and to deliver all such intercepted dialing, routing, addressing, and signaling 

information, securely and reliably and in a format that allows the information to be understood by 

the applicant. In particular, the United States requests that Sprint and any other person or entity 

providing wire or electronic communication service in the United States shall provide the 

following: 

• Any requested technical documentation and necessary assistance to enable the FBI 

to ascertain the meaning and significance of data in the delivery; to facilitate 

breaking down the information into distinct identifiable fields; and to address 

deficiencies and preferences with formats. 

• A designated technical representative(s)/engineer(s) who will coordinate efforts 

with and have the authority to provide the FBI's technical staff the necessary 

information and technical assistance, including direct access to the network 

facilities used or controlled by or on behalf of the FBI, and any other person or 

entity providing wire or electronic communication service in the United States to 

the target device, for purposes of testing, evaluation and implementation of the 

11 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 11 of 13 PAGEID #: 11
technical means necessary to accomplish the authorized pen register and a trap and 

trace device or process. 

36. The United States further requests that the Court order Sprint and any other person 

or entity whose assistance may facilitate execution of this Order to notify the applicant and the FBI 

of any changes relating to the cellular telephone number described in Attachment A, including 

changes to the International Mobile Subscriber Identifier ("IMSI"), and/or the International Mobile 

Station Equipment Identity (" IMEi") to include changes to subscriber information; and to provide 

prior notice to the applicant and the FBI before terminating or changing service to the cellular 

telephone number. 

37. The United States further requests that the Court order that the FBI and the applicant 

have access to the information collected by the pen-trap devices as soon as practicable, twentyfour hours per day, or at such other times as may be acceptable to them, for the duration of the 

Order. 

38. The United States further requests, pursuant to 18 U.S.C. § 3123(d)(2), that the 

Court order Sprint and any other person or entity whose assistance facilitates execution of this 

Order, and their agents and employees, not to disclose in any manner, directly or indirectly, by any 

action or inaction, the existence of this Application and Order, the resulting pen-trap devices, or 

this investigation, unless and until authorized by this Court, except that Sprint may disclose this 

Order to an attorney for Sprint for the purpose of receiving legal advice. 

39. The United States further requests that this Application and any resulting Order be 

sealed until otherwise ordered by the Court, pursuant to 18 U.S.C. § 3123( d)(l ). 

40. The United States further requests that the Clerk of the Court provide the United 

States Attorney's Office with three certified copies of this Application and Order, and provide 

copies of this Order to the FBI and Sprint upon request. 

12 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 12 of 13 PAGEID #: 12
41. The foregoing is based on information provided to me in my official capacity by 

agents of the FBI. 

I declare under penalty of perjury that the foregoing is true and correct. 

Executed on this 19th day of January, 2018. 

13 

Respectfully submitted, 

BENJAMIN C. GLASSMAN 

United States Attorney 

s/Karl P. Kadon III 

KARL P. KADON III (0009324) 

Assistant United States Attorney 

221 East Fourth Street, Suite 400 

Cincinnati, Ohio 45202 

Office: (513) 684-3711 

Fax: (513) 684-2047 

E-mail: Karl.Kadon@usdoj.gov 

Case: 1:18-mj-00037-SKB Doc #: 1 Filed: 01/19/18 Page: 13 of 13 PAGEID #: 13