Adam James Jun v. State of Maryland, No. 29, September Term, 2025. Opinion by Gould, J.
EVIDENCE – EXPERT TESTIMONY
A lay witness may recite the contents of a business record—and may draw on his familiarity with the kind of record at issue to do so efficiently—so long as the inference the testimony is offered to support is one an average layperson could draw from the record itself. When, instead, the witness must apply specialized methodology to translate, reformat, or interpret records that are not otherwise decipherable by a layperson, the witness must be qualified as an expert.
EVIDENCE – EXPERT TESTIMONY
The Supreme Court of Maryland held that it is not “beyond the ‘ken’ of the average layman” that accessing the internet requires service from an internet service provider, that the service provider knows which subscriber is using its service at any given time, and that the subscriber’s account is tied to a physical address (the point where a user accesses the internet). The Supreme Court of Maryland further held that the proposition that the internet runs through service providers that know the identities and locations of their subscribers is “common knowledge in modern society” and within the “range of perception and understanding” of the average layperson.
EVIDENCE – EXPERT TESTIMONY
The Supreme Court of Maryland held that expert testimony was not needed for a witness to read social media platform records that were understandable by reference to a legend produced with them. The inference that the records were intended to elicit was within ordinary perception.
EXPERT TESTIMONY – HARMLESS ERROR
The Supreme Court of Maryland held that testimony that an investigator gave to explain whether an IP address was “static” or “dynamic” drew on his “training, knowledge, and experience” and was expert testimony because those propositions were not within the ken of an average juror, but instead required an explanation from someone with specialized training or experience. Nonetheless, the Supreme Court of Maryland concluded that the admission of such testimony was harmless error because the State had demonstrated beyond a reasonable doubt that the error did not influence the verdict. Circuit Court for Anne Arundel County
Case No.: C-02-CR-23-000477
Argued: December 8, 2025
IN THE SUPREME COURT
OF MARYLAND
No. 29
September Term, 2025
ADAM JAMES JUN
v.
STATE OF MARYLAND
Fader, C.J.,
Watts,
Booth,
Biran,
Gould,
Eaves,
Killough,
JJ.
Opinion by Gould, J.
Watts, J., dissents.
Filed: June 22, 2026
Pursuant to the Maryland Uniform Electronic Legal
Materials Act (§§ 10-1601 et seq. of the State
Government Article) this document is authentic.
2026.06.22
14:58:48 -04'00'
Gregory Hilton, Clerk
In this appeal from multiple convictions for the possession and distribution of child
pornography, we must decide whether the lead investigator’s testimony about the contents
of records produced by an internet service provider and a social media platform required
the investigator to be qualified as an expert under Maryland Rule 5-702, or whether his
testimony could have been admitted as lay testimony under Rule 5-701. The trial court
admitted the records as certified business records and permitted the explanatory testimony
as lay testimony.
As we explain below, the testimony about the IP address associated with the
defendant’s home and about the content of the chat logs from the social media platform
Kik fell within the range of perception and understanding of an average layperson, was
largely a recitation of what the records said, and reflected a common-sense connecting of
the dots. And although, on cross-examination, the detective’s testimony ventured beyond
lay testimony when he drew upon his “training, knowledge, and experience” to explain the
distinctive characteristics of two types of IP addresses—IPv4 and IPv6—the court’s error
in allowing such testimony was harmless beyond a reasonable doubt. Accordingly, we
affirm.
I
A
The State charged Adam James Jun with ten counts of distributing a visual
representation of a minor engaged in sexual conduct and ten counts of the lesser-included
offense of possessing such material. See MD. CODE ANN., CRIM. LAW (“CL”) §§ 11-207(a)(4), 11-208 (2021 Repl. Vol.). During a four-day bench trial before the Honorable Michael E. Malone in the Circuit Court for Anne Arundel County, the State’s primary
witness was Detective Jonathan Bruce of the Anne Arundel County Police Department, an
officer assigned to the Child Abuse/Internet Crimes Against Children Unit and the lead
detective in investigating the matter. The State staked its case against Mr. Jun on certified
records from Verizon and from the social media platform Kik, both of which were
introduced through and explained by Detective Bruce.
The investigation into Mr. Jun began with a tip from the National Center for Missing
and Exploited Children (“NCMEC”), which had received a report that child sexual abuse
material was being transmitted from a Kik account with the username “aj1848884”
associated with the IP address 74.103.25.220 (the “220 IP address”).1 Detective Bruce then
subpoenaed records from Verizon, the internet service provider associated with that IP
address, and received in response a certified record identifying the subscriber as Adam Jun,
at 503 Darlene Avenue, Linthicum Heights, Maryland, 21090, with the email address
ajun1800@gmail.com.
Detective Bruce also subpoenaed records from Kik. The records produced by Kik
included four sets of materials: (1) subscriber information for the account “aj1848884”;
(2) images and videos containing child sexual abuse material sent from and received by
that account; (3) two chat-log folders containing a record of messages sent and received,
captioned “Chat_platform_sent.txt” and “Chat_platform_sent_received.txt”; and (4) a
1
NCMEC is a private, nonprofit organization that receives reports from electronic service providers concerning suspected child sexual abuse material and forwards those reports to law enforcement. NCMEC, About Us, available at https://perma.cc/VW34-FZYJ.
2
legend explaining how to read the chat logs. The Kik subscriber information identified “AJ
Jones” as the account’s creator, “aj1848884” as the username, listed a Samsung Android
device as the registered device, and showed the same 220 IP address as the tip from
NCMEC, confirmed by Verizon to be associated with Mr. Jun and his home address.
At trial, Detective Bruce broke this information down. He explained that an IP
address is an “assigned Internet protocol address that you get from [an] Internet service
provider so that you could access the Internet” and that, during an investigation, an
investigator can subpoena records from the internet service provider to determine the
subscriber and physical address associated with a particular IP address. He confirmed that
the Verizon record reflected that the 220 IP address was assigned to Mr. Jun at his home
in Linthicum Heights.
Detective Bruce then walked through the Kik records. He described ten image and
video files produced by Kik that he identified as child sexual abuse material. He testified
as to each of the files in turn, identifying the file name and the depicted content.
Next, Detective Bruce turned to the Kik chat logs, which were the heart of the
State’s case. The Kik legend identified the column headers in the “Chat_platform_sent.txt”
file—the file documenting “Individual chats sent that include media/images”—as
“Timestamp,” “User JID,” “Related User JID,” “App Name,” “Content ID,” “User IP,”
“Date,” and “Time.” The legend also identified the columns in the
“Chat_platform_received.txt” file—which it described as “Individual chats received that
include media/images”—to have the same headings without “User IP.”
3
Using the legend, Detective Bruce essentially read the entries from left to right.2 He
explained that the logs identified the sending account, the receiving account, the file
transmitted, the IP address from which it was sent, and the date and time of transmission.
Cross-referencing the file names in the logs against the file names that he had previously
identified as associated with child sexual abuse material, Detective Bruce testified that the
“aj1848884” account had received ten such files and that Mr. Jun had sent those files to
other Kik users on more than ten occasions, in each case but two from the 220 IP address.3
Mr. Jun objected to Detective Bruce’s testimony both before and during trial, arguing that
the interpretation of the Verizon and Kik records required “significant inferential leaps”
made possible only with the assistance of an expert qualified under Rule 5-702.
The trial court indicated pretrial that it was inclined to require expert testimony to
explain the documents, but at trial, the court overruled Mr. Jun’s objections, likening
Detective Bruce’s task to translating a foreign language. With respect to the terms “User
JID” and “Related User JID” in particular, the court found that those concepts were within
“common knowledge of society,” analogizing them to the inbox and outbox of an email
account.
2
To facilitate Detective Bruce’s testimony, the State also furnished summary exhibits that put the information from the Kik records into a more readable spreadsheet format that focused on the child sexual abuse material images Mr. Jun had sent and received.
3
In those two instances, a file identified as child sexual abuse material was sent from a different IP address. But that does not alter the outcome because earlier the same day, April 20, 2022, the same file was sent from the IP address tied to Mr. Jun’s home. And Detective Bruce testified to as much.
4
Mr. Jun was convicted of eight counts of distributing a visual representation of a
minor engaged in sexual conduct and eight counts of possessing a visual representation of
a minor engaged in sexual conduct. In rendering its verdict, the trial court stated that it
“listened [to] and considered all the evidence, including, but not limited to, the testimony,
the admitted exhibits, and the accepted stipulations.” The court sentenced Mr. Jun to an
aggregate term of 80 years’ incarceration, with all but 18 months suspended, followed by
five years of supervised probation.
B
The Appellate Court of Maryland affirmed in a reported opinion. Jun v. State, 265
Md. App. 459 (2025). Relying on State v. Galicia, 479 Md. 341 (2022), Johnson v. State,
457 Md. 513 (2018), and Freeman v. State, 487 Md. 420 (2024), the court concluded that
the Verizon and Kik records, read alongside the Kik legend, were within the range of
perception and understanding of an average layperson, and that Detective Bruce’s
testimony amounted to a recitation of those records rather than an expert interpretation of
them. Jun, 265 Md. App. at 478-79.
We granted Mr. Jun’s petition for a writ of certiorari on one of the two questions he
presented. Jun v. State, 492 Md. 382 (2025). That question, as Mr. Jun framed it, is whether
the trial court erred by allowing “a lay witness, instead of a properly qualified expert, to
testify about the nature and evidentiary significance of IP addresses and business records
from the social media application ‘Kik’[.]”
Ordinarily, we review evidentiary rulings for an abuse of discretion. Galicia, 479
Md. at 389 (citation omitted). But where, as here, the question is whether the nature of the
5
subject matter required expert testimony under Rule 5-702, the issue is a legal one that we
review without deference. Id. (citation omitted).
II
Rule 5-701 provides that:
[i]f the witness is not testifying as an expert, the witness’s testimony in the
form of opinions or inferences is limited to those opinions or inferences
which are (1) rationally based on the perception of the witness and (2) helpful
to a clear understanding of the witness’s testimony or the determination of a
fact in issue.
Rule 5-702, in turn, permits expert testimony “in the form of an opinion or otherwise, if
the court determines that the testimony will assist the trier of fact to understand the
evidence or to determine a fact in issue.” But such testimony is permitted only if the court
determines that (1) the witness is qualified by “knowledge, skill, experience, training, or
education,” (2) expert testimony is appropriate on the subject, and (3) a sufficient factual
basis supports the testimony. Md. Rule 5-702(1)-(3).
Although the line between lay and expert testimony is not always clear, expert
testimony has been required when evidence necessitates specialized “knowledge, skill,
experience, training or education” to understand, Johnson, 457 Md. at 534 (citing State v.
Payne, 440 Md. 680, 701 (2014), or when a witness’s opinion or inference is “so
particularly related to some science or profession that [it] is beyond the ken of the average
layman,” Galicia, 479 Md. at 389 (quoting Johnson, 457 Md. at 530). The “determinative
factor between lay opinion testimony under Maryland Rule 5-701 and expert opinion
testimony under Maryland Rule 5-702 is whether the topic and the foundation undergirding
it lies within the ‘ken’ of a layperson.” Freeman, 487 Md. at 435.
6
Four precedents will guide our analysis, so we’ll briefly discuss each. In State v.
Payne, a detective, not qualified as an expert, analyzed Sprint Nextel call records to identify
the cell towers through which the defendants’ phones had connected on the night of a
murder, mapping those towers in relation to the crime scene. 440 Md. at 685-89. We held
that the detective should have been qualified as an expert under Rule 5-702 for two reasons.
Id. at 700. First, he had to apply “specialized knowledge to translate the voluminous
records into something the jury could understand[,]” Johnson, 457 Md. at 534 (explaining
Payne, 440 Md. at 701-02), culling thousands of pages of irrelevant data and deciphering
the technical fields—“LAC ID” and “Cell ID”—that identified particular cell towers within
the carrier’s records, Payne, 440 Md. at 685, 700-01. These fields were particularly
confusing, we said, because the context in which they appeared (within Call Detail Record
entries) was too complicated for a juror to understand. Id. at 701. Second, the detective
determined the location of those cell towers and the communication path of each call from
coordinates that “only an expert could derive[]” from data that was “not decipherable based
on ‘personal experience.’” Id. at 700-02 (citation omitted).
In Johnson v. State, we affirmed the admission of a police sergeant’s reading of a
GPS-tracking report as lay testimony. 457 Md. at 537. We observed that the GPS report
did not use technical language, that its content could be understood without specialized
knowledge, and thus, the report was “not beyond the ken of the average juror.” Id. at 535.
In State v. Galicia, the central issue was whether “a witness must be qualified as an
expert to testify that a user of a smartphone may turn off the location tracking feature of an
application on the phone.” 479 Md. at 349. At trial, the State sought to introduce evidence
7
concerning internet searches and location tracking from the defendant’s Google accounts,
specifically, that a gap in the location records corresponded with the time during which the
murder occurred, thus creating an inference that the defendant had turned off his location
tracking to conceal his involvement. Id. at 385-86, 388.
We held that “a user’s ability to adjust the location tracking feature of a smartphone
is within the understanding of the average lay person and that a witness whose testimony
referred to that ability did not have to be qualified as an expert.” Id. at 349. We
distinguished Payne on the ground that, unlike in Payne, the custodian “used no specialized
skill to reformat or translate any of the raw data” and that the gap was “obvious in the
exhibit.” Id. at 393. As we explained, the question is not whether the average person is
already knowledgeable about a given subject, “but whether it is within the range of
perception and understanding.” Id. at 394. We held that it is a matter of common knowledge
that a mobile device “allows its users to customize the data they share with the
manufacturer, the cell phone service provider, and various apps[.]” Id.
Most recently, in Freeman v. State, we confirmed that a witness’s reliance on his
training and experience does not, on its own, transform lay testimony into expert testimony.
487 Md. at 436-38. A detective in Freeman was properly permitted to testify as a lay
witness that the slang term “lick” referred to a robbery. Id. at 435-36. Although he relied
on his years investigating robberies to recognize the term, the witness’s “opinion [was]
derived from processes that were discernible to the average person” and so the inference
his testimony was offered to support did not require an expert. Id. at 436-38.
8
The principle that emerges from these cases is this: A lay witness may recite the
contents of a business record—and may draw on his familiarity with the kind of record at
issue to do so efficiently—so long as the inference the testimony is offered to support is
one an average layperson could draw from the record itself. See Galicia, 479 Md. at 395.
When, instead, the witness must apply specialized methodology to translate, reformat, or
interpret records that are not otherwise decipherable by a layperson, the witness must be
qualified as an expert. See Payne, 440 Md. at 700-02.
III
A
Mr. Jun contends that Detective Bruce’s testimony about the Verizon and Kik
records and the nature of IP addresses was expert testimony governed by Rule 5-702. He
argues that an average person could not, without expert assistance, understand that an IP
address connects a device to the internet and that one’s IP address is tied to the physical
address where a person accesses the internet. Internet users, he continues, do not enter an
IP address to access the internet, do not see IP addresses on a consumer bill, and do not
understand the “function of an IP address[.]” The error in admitting Detective Bruce’s
testimony was further compounded, says Mr. Jun, when the detective relied on Mr. Jun’s
IP address in concluding that he had sent and received child sexual abuse material.
According to Mr. Jun, the chain of inferences drawn from the Verizon and Kik records
required the “special skill acquired through [Detective Bruce’s] years of experience as an
investigator[.]”
9
We disagree. Detective Bruce’s testimony about the Verizon report required an
ability to read, not to interpret. The record was short. It identified the 220 IP address, the
subscriber’s name (Adam Jun), the service address in Linthicum Heights, and the email
associated with the account. Detective Bruce’s testimony on direct examination recited the
information on the face of the document.
To be sure, Detective Bruce also explained what an IP address is and how it ties a
subscriber to a service provider and a physical address. In our view, that, too, did not cross
the threshold into expert testimony. We agree that few members of the public could explain
the technical aspects of an IP address, such as how an IP address connects users and service
providers, and that such technical details are not “common knowledge in modern society.”
See Galicia, 479 Md. at 394. Yet, it is not “beyond the ‘ken’ of the average layman” that
accessing the internet requires service from an internet service provider, that the service
provider knows which subscriber is using its service at any given time, and that the
subscriber’s account is tied to a physical address (the point where a user accesses the
internet). See id. As we observed in Galicia, smartphone ownership exceeds 95% among
American adults aged 18 to 49. Id. at 393. Anyone who has set up home internet service,
signed an apartment lease that included Wi-Fi, or paid a monthly Wi-Fi bill understands
that their service provider knows who is using its network and where.
Mr. Jun resists this conclusion by arguing that what is “within the range of
perception and understanding” should be measured by what the public knows, not by what
the public could understand if it paused to think about it. The reasoning we applied in
Galicia forecloses that approach. There, we were asked whether a mobile device user’s
10
ability to toggle location tracking on and off was within the average person’s range of
perception and understanding. Galicia, 479 Md. at 349. We explained that “[w]hen a court
considers whether testimony is beyond the ‘ken’ of the average layman, the question is not
whether the average person is already knowledgeable about a given subject, but whether it
is within the range of perception and understanding.” Id. at 394.
That rule still applies. Regardless of whether a person has paused to learn how an
IP address works, the proposition that the internet runs through service providers that know
the identities and locations of their subscribers is “common knowledge in modern
society[]” and within the “range of perception and understanding” of the average layperson.
See id. At bottom, the Verizon report is intuitive, and the inference it was used to draw—
that the 220 IP address was assigned to Mr. Jun and tied to his home and email address—
is easily reached.
Mr. Jun’s next argument likens Detective Bruce’s work to that of the detective in
Payne. He contends that Detective Bruce “hone[d] in” on the 220 IP address among those
listed in the NCMEC report and “eliminat[ed] ‘extraneous data’ in the records”—namely,
the IP addresses likely outside of his Anne Arundel County jurisdiction—just as the Payne
detective culled thousands of pages of call detail records. And, according to Mr. Jun, with
that information, Detective Bruce knew which IP addresses he should focus on in the Kik
records. So, Mr. Jun submits, Detective Bruce was providing expert testimony, not lay
testimony.
The analogy to Payne does not hold. There, a detective first sifted through
“thousands of pages” of raw cell-tower routing data and narrowed the entries down to, at
11
most, fifty pages of “pertinent” data, 440 Md. at 685, and then further relied on his
“technical background” to understand which fields—“LAC ID” and “Cell ID”—identified
the cell towers near the crime scene, id. at 697-98, 701. The detective in Payne had to
identify (within thousands of pages of data) which callers were suspicious, what the fields
meant, and derive geographic coordinates from them, all before any layperson could make
use of the records. Id. at 700-01.
Detective Bruce, on the other hand, did no such thing. The “sent” file he reviewed
was only, as produced in the record, five pages long. To the extent he needed to eliminate
extraneous information, it wasn’t much, and he didn’t need to rely on any expertise to do
so. The detective focused on only the 220 IP address in reviewing the “sent” file because
the Verizon report traced it to an Anne Arundel County subscriber within its jurisdiction.
A layperson presented with the Verizon report and the Kik records could spot the same
connection.4
We therefore hold that Detective Bruce’s testimony about the Verizon report,
including his general explanation of what an IP address is and how it could be tied to a
service provider’s subscriber, was properly admitted under Maryland Rule 5-701.
4
Mr. Jun relies on People v. Garrison, 411 P.3d 270 (Colo. App. 2017), and Commonwealth v. Manivannan, 186 A.3d 472 (Pa. Super. Ct. 2018), as authority to support his argument that the link between an IP address and a physical location is, as a categorical matter, beyond ordinary knowledge and so requires expert testimony. We reviewed those authorities and are not persuaded.
12
B
Mr. Jun argues that Detective Bruce’s testimony interpreting the Kik chat logs—
using the Kik-supplied “legend” as a guide—required expert qualification because the logs
used arcane field names—“User JID” and “Related User JID.” According to Mr. Jun, a
jury could understand these terms only with the help of a witness with specialized
experience and training, that is, an expert. Mr. Jun also points to the trial court’s
observation that what the detective was doing was “somewhat akin” to “translating a
foreign language.” We disagree for three reasons.
First, the logs came with their own decoder ring. Kik produced, alongside the chat
logs, a legend that identified the column headers in each file. Detective Bruce did not divine
the meaning of the columns from his training and experience, but rather relied on the legend
to interpret the logs and ascertain their meaning. In contrast, the detective in Payne had to
apply his own training and experience to “parlay” the unreadable records into useful
evidence. 440 Md. at 700-01.
Second, even if a layperson reading the legend cold might pause at “User JID” and
“Related User JID,” that gap in knowledge does not require an expert to bridge. As the trial
court observed, these two terms—however unfamiliar—plainly referred to senders and
recipients of files, “like looking at one inbox and outbox . . . in an email[,]” which is “a
common knowledge of society.” The trial court’s analogy was apt. A reader of the Kik logs
encounters two account names per line, sees that one is “aj1848884” and the other is some
other Kik username, and observes that unique files were transmitted between them on the
13
identified dates. The conclusion that one user sent and the other received a particular file
requires only that the reader follow the rows from left to right with the legend in hand.
Mr. Jun responds to this point by noting that the trial court stated that Detective
Bruce’s work was “somewhat akin” to “translating a foreign language.” Mr. Jun reads too
much into the court’s analogy. Translation can mean different things in different contexts.
It can mean rendering content from a language the reader does not know into one the reader
does, in which case a qualified translator may apply her own specialized linguistic
expertise. Or it can mean using a foreign language dictionary and grammar guide to piece
together, word by word, a translation of a sentence from one language into another—
something an average layperson can, with patience, accomplish. That latter task more
closely resembles what happened here. True, the logs were in a coded format, but Kik’s
legend supplied the code. A reader could match “User JID” against the first account name
in each row and “Related User JID” against the second. That’s what the trial court did here.
Third, it does not change the analysis that Detective Bruce’s experience working in
the Child Abuse/Internet Crimes Against Children Unit may have enabled him to parse the
logs faster and more confidently than a layperson. As we held in Freeman, that a witness
might rely on his or her experience in formulating an opinion does not mean that the witness
needs to be qualified as an expert. 487 Md. at 437-38. What matters is that in testifying,
the witness does not rely on knowledge outside the realm of general understanding, see id.,
14
and that the inference the testimony is offered to support lies within the ken of an average
person, Galicia, 479 Md. at 395.5
Mr. Jun sees things differently. He insists that Freeman is distinguishable because,
there, the detective’s familiarity with the term “lick” came from “everyday experience in
hearing and using language” rather than from specialized, work-specific training. We
disagree. For one, we have already determined that expert training was not required to
understand the Verizon or Kik records. For another, Mr. Jun misunderstands Freeman. In
Freeman, we did not hold that expert testimony is required whenever evidence is in a form
unfamiliar to laypersons. Rather, we determined that the slang term “lick” was within the
ordinary perception, and even though many laypeople would not personally know its
meaning, in the appropriate context they could nonetheless infer, without expert testimony,
that the petitioner used the term to mean “robbery.” Freeman, 487 Md. at 426, 436-39.
The same is true of the structure of a Kik chat log displayed alongside its legend.
The inference that the chat logs were intended to elicit here—that the “aj1848884” account,
registered to Mr. Jun’s IP address, sent and received certain files identified by a file name—
lies within ordinary perception. Laypersons of average intelligence could match the file
names in the logs to the file names of the images Detective Bruce identified as child sexual
abuse material and conclude for themselves that Mr. Jun sent and received these materials.
5
Think of it this way. Certain brands of furniture come with detailed diagrams showing step-by-step assembly instructions. Such instructions are designed for a layperson to follow and apply, and although it might be difficult for some, particularly those who do not style themselves as “handy,” their ability to do so improves with experience. As we see it, reviewing and understanding the Kik records is similar.
15
We therefore hold that Detective Bruce’s testimony about the Kik chat logs and the
legend was properly admitted as lay testimony under Maryland Rule 5-701.
IV
A
That leaves Detective Bruce’s testimony about the distinction between IPv4 and
IPv6 addresses and the “static” character of the 220 IP address. On this narrower point, we
agree with Mr. Jun that such testimony fell within the ambit of expert testimony under Rule
5-702 and therefore was inadmissible as lay testimony under Rule 5-701. We nonetheless
conclude that the error was harmless beyond a reasonable doubt.
The IPv4/IPv6 testimony was elicited during defense counsel’s cross-examination
of Detective Bruce in an effort to expose a gap between the dates the Verizon record
covered and the dates that the Kik logs showed file transfers from the 220 IP address.
Defense counsel pressed the detective on whether the Verizon records established that the
220 IP address was assigned to Mr. Jun and could be traced back to his residence on the
precise dates the Kik logs showed the exchange of child sexual abuse material. In response,
Detective Bruce drew on his “training, knowledge, and experience” to explain that the 220
IP address was a “static” IPv4 address—a category that, in his experience, did not change
“that often” and was “more reliable than an IPv6” address.
That testimony fell on the Payne side of the line. Unlike the general proposition that
an IP address ties a user to a service provider, the distinction between the function of IPv4
and IPv6 addresses and the claim that IPv4 assignments are typically “static” are not
propositions within the ken of an average juror, but instead require an explanation from
16
someone with the specialized training or experience that, in this case, came from working
internet-crimes investigations. Because testimony of that character should be admitted only
after the witness is qualified under Rule 5-702, Payne, 440 Md. at 700-03, the trial court
erred in admitting that specific testimony as lay testimony.
B
An error in admitting evidence does not require reversal if the State demonstrates
beyond a reasonable doubt that the error “in no way influenced the verdict[.]” Dorsey v.
State, 276 Md. 638, 655 (1976); see also Gross v. State, 481 Md. 233, 259 (2022)
(reaffirming the Dorsey standard). Critical to this inquiry is whether the evidence presented
in error was merely “cumulative evidence.” Dove v. State, 415 Md. 727, 743 (2010). Thus,
here, the essential question is “whether the cumulative effect of the properly admitted
evidence so outweighs the prejudicial nature of the evidence erroneously admitted that
there is no reasonable possibility” of a different result. Id. at 744 (citation modified). On
this record, the State has carried its burden.
Mr. Jun urges that a harmless error finding is inappropriate because the trial court
stated that it “considered all the evidence” in reaching its verdict, which, he argues,
parallels the bench trial situation in Hutchins v. State, 339 Md. 466, 479 (1995), where this
Court concluded that the trial judge had relied on improperly admitted expert testimony.
Mr. Jun notes that in Hutchins, 339 Md. at 477, this Court stated that “had the trial judge
recognized the State’s obligation to disclose[,]” the experts “may not have been permitted
to testify at all.” Mr. Jun argues that the same logic applies here.
17
Mr. Jun’s harmless error argument and his reliance on Hutchins would carry more
force if we accepted his argument that all of Detective Bruce’s testimony was inadmissible.
But given the limited basis on which we find error, we are persuaded beyond a reasonable
doubt that the inadmissible testimony elicited on cross-examination did not influence the
verdict. See Dorsey, 276 Md. at 655.
First, the IPv4/IPv6 testimony was narrow in scope and limited in function.
Detective Bruce merely offered, in response to cross-examination questions designed to
undermine the connection between the Verizon and Kik records, the conclusion that the
220 IP address was a “static” IPv4 address that does not often change. Further, the State,
in closing, did not rely on the IPv4/IPv6 distinction. And, the record does not suggest that
the trial court rested its findings of guilt on that distinction.
Second, the evidence connecting Mr. Jun to the 220 IP address and to the Kik
account that transmitted the material was overwhelming on grounds independent of the
IPv4/IPv6 testimony. The Verizon report identified Mr. Jun as the subscriber assigned the
220 IP address. The Kik subscriber record showed that the “aj1848884” account was
registered to a Samsung Android device with the same 220 IP address as the user location.
The Kik logs showed transmissions of files—matched by file names to images Detective
Bruce identified as child sexual abuse material, from the “aj1848884” account—using that
IP address across multiple dates in April and May 2022. The same Kik production
contained photographs of Mr. Jun, his wife, and minor children of family friends—images
that were unlikely to have been sent by someone other than Mr. Jun. And Mr. Jun gave an
inculpatory statement to police in which he acknowledged viewing pornography on Kik,
18
conceded that the files included material involving “prepubescent” teenagers and children,
and twice responded “Okay” when told that the material traced to his account was
“underage material” or “clear cut child pornography.”
Against that record, Detective Bruce’s brief reference to the IPv4 address and the
“static”6 character of that address was cumulative reinforcement of a connection the State
had already established by independent means. See Gross, 481 Md. at 262–65 (pointing
out that cumulative evidence may render an error harmless that would otherwise be
reversible). The Verizon report connected the 220 IP address to Mr. Jun’s home, and the
Kik records showed transmissions from that same IP address. Thus, the relevant link—that
the 220 IP address was assigned to Mr. Jun and that the Kik account using that IP address
transmitted child sexual abuse material—did not depend on Detective Bruce identifying
the distinction between static or dynamic IP addresses.
Mr. Jun separately argues that the trial court judge’s self-description as an “average
person . . . tech-wise” shows that the judge himself needed Detective Bruce’s testimony to
understand the Verizon and Kik records, thus precluding a finding that the error was
harmless. However, the judge’s remarks do not mean that he relied on this narrow piece of
improperly admitted expert testimony to reach his understanding. The portions of Detective
Bruce’s testimony that we have held were properly admitted as lay testimony—the reading
6
Even assuming that Mr. Jun’s IP address was not static, this would not negate that: (1) the “sent” file notes that Mr. Jun, on multiple occasions in April and May 2022, sent images identified to be child sexual abuse material from the 220 IP address, and (2) those files were sent from a Kik account with the username “aj1848884” (which was connected to Mr. Jun).
19
of the Verizon report and the reading of the Kik logs with the legend—independently
grounded that understanding. The IPv4/IPv6 testimony we have held should have been
excluded was, as we have explained, peripheral to the State’s case and untethered to the
trial court’s judgment.
For these reasons, we are satisfied beyond a reasonable doubt that the error in
admitting the IPv4/IPv6 testimony as lay testimony did not influence the verdict and as
such, was harmless.
JUDGMENT OF THE APPELLATE
COURT OF MARYLAND
AFFIRMED. COSTS TO BE PAID BY
PETITIONER.
20
Circuit Court for Anne Arundel County
Case No. C-02-CR-23-000477
Argued: December 8, 2025
IN THE SUPREME COURT
OF MARYLAND
No. 29
September Term, 2025
ADAM JAMES JUN
v.
STATE OF MARYLAND
Fader, C.J.
Watts
Booth
Biran
Gould
Eaves
Killough,
JJ.
Dissenting Opinion by Watts, J.
Filed: June 22, 2026
Respectfully, I dissent. This case involved evidence related to an IP address that a
detective, as a lay witness, testified was associated with Mr. Jun’s home address and the
distribution of child sex abuse material on a social media application called Kik. I do not
agree with the Majority’s holding that the officer’s “testimony about the IP address
associated with the defendant’s home and about the content of the chat logs from the social
media platform Kik fell within the range of perception and understanding of an average
layperson, was largely a recitation of what the records said, and reflected a common-sense
connecting of the dots.” Maj. Slip Op. at 1. At bottom, an IP address is an internet or
digital mailing address. See Maj. Slip Op. at 3; see also IP address, MerriamWebster, https://www.merriam-webster.com/dictionary/IP%20address [https://perma.cc/
XT9M-5GVK]. But, without explanation, an IP address is not a concept whose definition
and meaning could be readily understood to establish a geographic location or a connection
to a software application.
What began in Johnson v. State, 457 Md. 513, 535, 179 A.3d 984, 996 (2018), with
this Court holding that an officer “literally reading” two entries about street addresses and
times as they appeared in a GPS report, that did “not use technical language and [we]re
decipherable without specialized knowledge[,]” was “not beyond the beyond the ken of the
average juror” has led to the Majority’s holding that “[a] lay witness may recite the contents
of a business record—and may draw on his familiarity with the kind of record at issue to
do so efficiently—so long as the inference the testimony is offered to support is one an
average layperson could draw from the record itself.” Maj. Slip Op. at 9 (citation omitted).
Saying that a witness may draw on his own familiarity to recite the content of a business record is a euphemism for saying that witnesses may draw upon their expertise to testify
about business records. The reasoning underlying the language “so long as the inference
the testimony is offered to support is one that an average layperson could draw from the
record itself” is unpersuasive. If the inference that the testimony is offered to support is
one an average layperson could draw from the record itself, why would there be the need
for a witness to draw “on his own familiarity with the record” i.e., expertise, to explain the
record?
None of our case law stands for the holding that the Majority has announced—not
Johnson (which is discussed above), State v. Galicia, 479 Md. 341, 278 A.3d 131 (2022),
or Freeman v. State, 487 Md. 420, 318 A.3d 1241 (2024). In Galicia, 479 Md. at 349, 278
A.3d at 135, the primary question involved “whether a witness must be qualified as an
expert to testify that a user of a smartphone may turn off the location tracking feature of an
application on the phone.” We held that “a user’s ability to adjust the location tracking
feature of a smartphone is within the understanding of the average lay person and that a
witness whose testimony referred to that ability did not have to be qualified as an expert.”
In Freeman, 487 Md. at 431, 318 A.3d at 1248, we held that a detective’s “opinion
regarding the definition of the slang term ‘lick’ [wa]s not expert testimony under Maryland
Rule 5-702.” We concluded that “[d]efining the slang term ‘lick’ is not beyond the ‘ken’
of a layperson and does not require expertise for admission.” Id. at 431, 318 A.3d at 1248.
We explained that the detective offered “a nontechnical definition for a colloquial slang
term.” Id. at 436, 318 A.3d at 1251. We stated that the detective “testified to having
-2-familiarity with the term ‘lick’ during his tenure with the Robbery Unit.” Id. at 437 n.12,
318 A.3d at 1251 n.12. We observed that although the detective “testified that his opinion
was derived from his tenure with the robbery unit, and the questions from the Assistant
State’s Attorney referenced the officer’s ‘training and experience,’ the nature of his opinion
was not reliant on processes or methodology outside the ‘ken’ of a layperson.” Id. at 436-38, 318 A.3d at 1251-52.
Relying apparently on an observation in Freeman, which as explained, is a case in
which an officer was permitted to testify as a lay witness based on his familiarity with a
one syllable slang term, the Majority has raised the bar for the circumstances under which
a witness must be qualified as an expert to testify by equating “expertise” with “familiarity”
as the permissible basis for lay testimony and holding that expert witness testimony must
“apply specialized methodology[.]” Maj. Slip Op. at 9. By using inferential references
through “See” cites to Payne and Galicia, the Majority has announced a new standard for
when expert testimony is required, namely, that,
[a] lay witness may recite the contents of a business record—and may draw
on his familiarity with the kind of record at issue to do so efficiently—so
long as the inference the testimony is offered to support is one an average
layperson could draw from the record itself. See Galicia, 479 Md. at 395.
When, instead, the witness must apply specialized methodology to translate,
reformat, or interpret records that are not otherwise decipherable by a
layperson, the witness must be qualified as an expert. See Payne, 440 Md. at
700-02.
Maj. Slip Op. at 9.
Although the Appellate Court erred in applying our case law, in affirming the
circuit court’s admission of the officer’s lay testimony, it relied on this Court’s conclusion
-3-in Galicia that in determining whether expert testimony is necessary our case law focuses
“on whether the information is ‘within the range of perception and understanding’ of the
average person and not whether they already know the information.” Jun v. State, 265 Md.
App. 459, 477, 335 A.3d 225, 236 (2025) (citing Galicia, 479 Md. at 394, 278 A.3d at 161).
Applying the standard that is set forth in our existing case law to the circumstances
of this case results in the conclusion that the circuit court abused its discretion in not
requiring that the detective in this case be offered as an expert. Put simply, the Majority’s
determination that “Detective Bruce’s testimony about the Verizon report required an
ability to read, not to interpret” and that a reading of the Kik records with the legend would
allow the average layperson to understand its contents is incorrect. Maj. Slip Op. at 10,
19-20. With respect to the records obtained from Kik, Detective Bruce testified as follows:
Kik provided me with the data pursuant to this warrant. That data, as I
mentioned before, was the two folders labeled “content” and “logs” which
included the subscriber information, the business -- the certificate of
authenticity, image files and videos that are associated with the account, and
the text documents in the logs folder.
Regarding how he accessed the records provided by Kik, Detective Bruce testified
that “[t]here was the main folder, the Zip encrypted folder provided by Kik. You unzip it,
and then two folders are provided: content and logs.” I would reject the State’s argument
that Detective Bruce’s testimony did not require explanation by an expert, and so should
the Majority. Plainly, information concerning what a “Zip encrypted folder” is or how the
detective “unzip[ped]” the folder would not be information that the average lay person
would already know, nor would it be information that is “within the range of perception
-4-and understanding” of the average lay person. Galicia, 479 Md. at 394, 278 A.3d at 161.
At trial, the State offered into evidence photos and videos and log pages from the “Zip
encrypted” content and log folders of the Kik records that had been “unzipped” by the
detective. As a threshold matter, the description of both of the folders and how the
detective accessed the Kik records within the folders required expert testimony.
Nonetheless, as to the Kik records, over Mr. Jun’s continuing objection, Detective
Bruce testified, among other things, as follows:
[THE STATE:] Detective Bruce, what if any useful information were you
able to glean with regard to your investigation with the subscriber
information provided from Kik?
[DETECTIVE BRUCE:] The first and last name listed here of A.J. Jones. I
could -- the registration time, the device -- or the type of device that was
used, which was an Android, the brand, which was Samsung, the model of
the device, which was SM-G996U, and the user location had the IP address
of 74.103.25.220.
Testimony at trial revealed that a Samsung mobile phone with the same model
number as the model number of the phone on the Kik records was recovered from Mr. Jun
incident to his arrest.
In addition, Detective Bruce testified about the Kik log files. Using the Kik log
files, Detective Bruce testified that the logs showed a username or an IP address associated
with Mr. Jun as the recipient or sender of content that Detective Bruce called child sex
abuse material. The circuit court admitted into evidence 42 pages of Kik log files. I have
attached a copy of the Kik and Verizon registration records, the Kik records’ legend titled
“Production Order Result Legend” that the Majority declares would allow a lay person to
-5-understand the meaning of the Kik log records, and a sample of the Kik log pages/records.
A review of the documents demonstrates that unless a person has education or training in
computer science or technology, the person would not understand the meaning of the Kik
legend and its contents, or how to interpret the Kik log records. Clearly, specialized
education or training was required to understand the meaning of the information in the Kik
legend and logs files.
In addition, although most people would know that an IP address is something that
might be identified to a computer, few people would know the technical definition of the
term, that a cellular telephone is connected to an IP address, or how an IP address functions,
i.e., the amount of information it can provide about a user, without some background or
expertise in technology or computer science. Even with an explanation of the function of
an IP address, few people would understand the technology that makes its function
possible.
Until today, this Court has consistently adhered to the principle that expert
testimony “is not required on matters of which the jurors would be aware by virtue of
common knowledge[,]” Johnson, 457 Md. at 530, 179 A.3d at 994 (citation modified), or
on matters “within the understanding of the average lay person[.]” Galicia, 479 Md. at
349, 395, 278 A.3d at 135, 162. Because Detective Bruce’s testimony about matters such
as the function of an IP address, the “Zip encrypted” Kik folders, unzipping the “Zip
encrypted” Kik folders and accessing their content, the meaning of the Kik legend, and the
interpretation of Kik log records involved testimony that clearly required knowledge,
-6-training, or experience in computer science or technology for an average member of the
public to understand, Detective Bruce’s testimony as a lay witness was not admissible. “If
a court admits evidence through a lay witness in circumstances where the foundation for
such evidence must satisfy the requirements for expert testimony under Maryland Rule 5-702, the court commits legal error and abuses its discretion.” Johnson, 457 Md. at 530,
179 A.3d at 994.
In this case, the error was reversible error. The State has not established beyond a
reasonable doubt that allowing Detective Bruce to testify as a lay witness about the
meaning of the Verizon and Kik records had no effect on the outcome of the case and was
harmless error. Quite the opposite. The records were the heart of the State’s case. These
were the documents that connected Mr. Jun to possession and distribution of pornographic
material on the Kik platform. To be sure, a person with education, training, or experience
in working with computers or with IP addresses may have understood the records without
the assistance of Detective Bruce’s testimony. Although this was a bench trial, contrary to
the State’s contention, there is no indication in the record that the judge “relied on his own
understanding of the records.”
Because the manner in which the records were stored and the technology that
resulted in the location and transmission data contained on the reports and the terminology
used in the Kik records, in particular, exceeds what is generally understood by the public,
expert testimony was required under the circumstances of this case to explain the meaning
of data in the reports. It cannot be established beyond a reasonable doubt that permitting a
-7-detective to testify as a lay person—that reports from an internet service provider and a
social media platform identified Mr. Jun as the most recent owner of an IP address and that
the materials that formed the basis of his conviction were received by or distributed from
that IP address—was harmless. Accordingly, I would reverse the judgment of the
Appellate Court, which affirmed Mr. Jun’s convictions.
-8-