Background
Adam James Jun was investigated after the National Center for Missing and Exploited Children forwarded a tip that child sexual abuse material was being transmitted through a Kik account linked to a specific IP address. Detective Jonathan Bruce of the Anne Arundel County Police Department subpoenaed records from Verizon, which identified the IP address as assigned to Jun at his home in Linthicum Heights, Maryland, and from Kik, which produced subscriber data, images and videos of child sexual abuse material, chat logs, and a legend explaining the log format. At a four-day bench trial in the Circuit Court for Anne Arundel County, Detective Bruce testified about the Verizon and Kik records as a lay witness without being qualified as an expert.
Jun objected throughout trial, arguing that interpreting the records required “significant inferential leaps” achievable only through expert testimony under Maryland Rule 5-702. The trial court overruled these objections, finding that Detective Bruce’s reading of the records was within the common knowledge of society. Jun was convicted of eight counts of distributing a visual representation of a minor engaged in sexual conduct and eight counts of possession, and sentenced to 80 years’ incarceration with all but 18 months suspended. The Appellate Court of Maryland affirmed, and the Supreme Court of Maryland granted certiorari.
The sole question before the Supreme Court was whether the trial court erred in allowing a lay witness, rather than a qualified expert, to testify about the nature and evidentiary significance of IP addresses and the business records of the social media platform Kik. On cross-examination, Detective Bruce also testified—drawing expressly on his “training, knowledge, and experience”—that the IP address at issue was a “static” IPv4 address, distinct from the more variable IPv6 type, a point the defense had raised to challenge whether the Verizon records reliably tied the address to Jun on the relevant dates.
The Court’s Holding
The Supreme Court of Maryland, in an opinion by Judge Gould, affirmed the convictions. The Court announced the governing rule: a lay witness may recite the contents of a business record—and may draw on familiarity with that type of record to do so efficiently—as long as the inference the testimony supports is one an average layperson could draw from the record itself. Where, however, the witness must apply specialized methodology to translate, reformat, or interpret records not otherwise decipherable by a layperson, the witness must be qualified as an expert under Rule 5-702.
Applying that standard, the Court held that Detective Bruce’s testimony about the Verizon records and the general nature of IP addresses was properly admitted as lay testimony. The Court reasoned that while few people can explain the technical mechanics of IP addressing, it is within the “range of perception and understanding” of the average layperson—not merely common knowledge already possessed—that accessing the internet requires a service provider, that the provider knows who is using its network and from where, and that a subscriber account is tied to a physical address. The Court similarly upheld the Kik chat-log testimony: the logs came with a Kik-supplied legend decoding all column headers, and reading the logs row by row with that legend in hand required nothing beyond ordinary intelligence.
The Court agreed with Jun on one narrow point: Detective Bruce’s testimony distinguishing “static” IPv4 addresses from IPv6 addresses—offered in response to cross-examination—was expert testimony improperly admitted as lay opinion, because those propositions lie outside the ken of the average juror and required specialized training to explain. Nonetheless, the Court held this error harmless beyond a reasonable doubt under Dorsey v. State, 276 Md. 638 (1976). The IPv4/IPv6 testimony was brief, elicited on cross-examination, not relied upon by the State in closing argument, and cumulative given the overwhelming properly admitted evidence connecting Jun to the Kik account and the charged conduct, including his own inculpatory statement to police.
Key Takeaways
- The lay-versus-expert distinction turns on whether the inference the testimony supports lies within the “range of perception and understanding” of an average layperson—not whether the average person already knows the answer, but whether they could understand it without specialized training.
- An investigator may read business records as a lay witness if the records are sufficiently self-explanatory (including with a legend or key supplied by the producing party) and no specialized methodology is needed to translate or reformat raw data for the fact-finder.
- Basic IP-address concepts—that an internet service provider knows which subscriber is using its service and at what physical address—are common knowledge in modern society and do not require expert testimony; the technical distinction between static IPv4 and dynamic IPv6 addressing, however, does.
- Improperly admitted expert testimony on the IPv4/IPv6 distinction was harmless error where the State’s properly admitted evidence was overwhelming and the disputed testimony played no apparent role in the verdict.
Why It Matters
This decision provides Maryland prosecutors and defense attorneys with a clearer framework for digital-records testimony in an era when IP addresses, social media logs, and ISP records are routine features of criminal investigations. By holding that basic internet infrastructure concepts are within ordinary lay understanding, the Court permits investigators to present such evidence efficiently without the procedural burden of expert qualification—while preserving the expert-testimony requirement for more granular technical claims, such as the behavior of specific IP-address protocols.
The ruling also reinforces the Court’s longstanding emphasis on what a layperson could understand, rather than what they already know, as the touchstone for the lay/expert divide—a standard with broad implications beyond cybercrime cases wherever investigators testify about records from digital platforms, financial institutions, or other data-rich sources. Defense practitioners should note that the harmless-error analysis here was heavily influenced by the narrowness of the error and the strength of the remaining evidence; cases where the disputed testimony is more central to the verdict may yield different outcomes.