Adam James Jun v. State of Maryland, No. 2232, Sept. Term 2023. Opinion by Shaw, J.
EVIDENCE – LAY WITNESS TESTIMONY – IP ADDRESSES
Detective could testify as a lay witness about the evidentiary significance of IP addresses, information within the Verizon and Kik records, and child sexual abuse material (“CSAM”) trading. Expert testimony is required “when the subject of the inference . . . is so particularly related to some science or profession that it is beyond the ken of the average layman[.]” State v. Galicia, 479 Md. 341, 389 (2022) (quoting Johnson v. State, 457 Md. 513, 530 (2018)). A trial court must consider whether the testimony is “within the range of perception and understanding” of the average person, not “whether the average person is already knowledgeable about a given subject[.]” Id. at 394. Internet usage is widespread in our present culture. Even if people do not know how an IP address is linked to a physical address, it is within the range of perception and understanding of the average layperson that the internet provided by their internet service provider allows them to use social media on their devices in their homes.
EVIDENCE – BUSINESS RECORDS – TRUSTWORTHINESS
The circuit court correctly admitted the Kik business records into evidence. Maryland Rule 5-803(b)(6) excepts records of regularly conducted business activity from the hearsay rule. The records, themselves, must be trustworthy. Here, nothing about the source of the records or the manner of their preparation indicates untrustworthiness and Kik’s custodian certified that the records were kept or made in their regular course of business. Circuit Court for Anne Arundel County Case No. C-02-CR-23-000477 REPORTED
IN THE APPELLATE COURT
OF MARYLAND
No. 2232
September Term, 2023
ADAM JAMES JUN
v. STATE OF MARYLAND
Reed, Shaw, Zic,
JJ.
Opinion by Shaw, J.
Filed: May 6, 2025
Pursuant to the Maryland Uniform Electronic Legal Materials Act (§§ 10-1601 et seq. of the State Government Article) this document is authentic.
2025.05.06 15:10:44 -04'00' Gregory Hilton, Clerk Appellant, Adam James Jun, was charged by information in the Circuit Court for
Anne Arundel County with ten counts of distributing a visual representation of a minor
engaged in sexual conduct, Md. Code Ann., Crim. Law § 11-207(a)(4), 1 and ten counts of
possessing a visual representation of a minor engaged in sexual conduct, Md. Code Ann.,
Crim. Law § 11-208. 2 He filed a motion in limine to preclude lay witness testimony
“interpreting the significance of internet protocol (‘IP’) records produced by Kik and
Verizon” and to preclude “the underlying business records.” At the conclusion of a hearing
on the issue, the court reserved ruling.
Appellant later elected to have a bench trial and Detective Jonathan Bruce of the
Anne Arundel Police Department was called as a State witness. He testified, over
Appellant’s objection, about the Kik and Verizon records and the significance of IP
addresses. The court ruled that the testimony did not require expert qualification.
Appellant was ultimately convicted of eight counts for each offense. He was sentenced to
eighty years of imprisonment with all but eighteen months suspended and five years of
supervised probation upon his release. Appellant timely appealed and he presents two
questions:
1. Did the trial court erroneously admit without a properly qualified expert witness: (a) testimony and documents linking a particular IP address to Jun’s
1 (a) A person may not:
(4) knowingly promote, distribute, or possess with the intent to distribute any matter, visual representation, or performance that depicts a minor engaged as a subject in sadomasochistic abuse or sexual conduct[.] 2 (a) A person may not knowingly possess a film, videotape, photograph, or other visual representation depicting an individual under the age of 16 years[.] home address, (b) testimony, documents, and demonstrative exhibits conveying information about file transfers through the social media application Kik, and (c) testimony about “trading” child sexual abuse material?
2. Did the trial court abuse its discretion by not excluding for lack of trustworthiness business records from social media company Kik?
For the following reasons, we affirm.
BACKGROUND
Following Appellant’s indictment in the Circuit Court for Anne Arundel County on
charges of distributing a visual representation of a minor engaged in sexual conduct, Md.
Code Ann., Crim. Law § 11-207(a)(4), and possessing a visual representation of a minor
engaged in sexual conduct, Md. Code Ann., Crim. Law § 11-208, he filed a motion in
limine. During a pre-trial hearing on the motion, Appellant argued that the State needed
an expert witness to testify that an IP address accessed at a specific location can identify
the person responsible for the account. Appellant asserted that “in order to understand the
Kik records, the Verizon records, and tie the case back” to him, an expert was needed to
explain “significant inferential leaps[.]” The court reserved ruling on the issue until trial.
Appellant elected a bench trial, and during that trial the State called Detective
Jonathan Bruce as a witness. Detective Bruce testified that he had been with the Anne
Arundel County Police Department for five years, and he spent three of those years with
the Internet Crimes Against Children Task Force. In this position, he received an estimated
350 to 400 tips from the National Center for Missing and Exploited Children (“NCMEC”),
and approximately “99 percent of the time,” these tips included an IP address. He testified
2 that an IP address is an “assigned Internet protocol address that you get from [the] Internet
service provider so that you could access the Internet.”
The prosecution asked Detective Bruce “what, if any, evidentiary value comes from
the IP address?” The defense objected, arguing that the detective was not an expert with
the requisite training and experience to answer. The court initially sustained the objection,
stating that the State needed to “provide a little more foundation.” Detective Bruce then
testified more about his investigative process and his background experience before the
prosecution again asked “what, if anything, of evidentiary value can you obtain from
knowing information about an IP address?” Appellant’s counsel again objected, and the
court overruled his objection without explanation. Detective Bruce answered, stating that
the “benefit of knowing the information behind an IP address is [knowing] where that
activity is coming from, so specifically, a location.” He added that “the subscriber
information to that IP, . . . who is listed on the account,” could also be found from the
investigation of an IP address.
The State asked Detective Bruce to describe the tip that prompted his investigation
of Appellant. Detective Bruce stated that he received a tip of reported child sexual abuse
material (“CSAM”) 3 from NCMEC. NCMEC had obtained the information from a social
media application known as Kik. 4 Detective Bruce testified that the tip listed “aj1848884”
3 CSAM is also known as child pornography.
Kik is a social media application that allows people to “send and receive text 4
messages, images, and videos.”
3 as the Kik username, “ji44m@gmail.com” as the registered email address, and
“74.103.25.220” as the IP address. 5 He confirmed that the tip had eighteen “unique files”
of images that were “consistent with” child sexual abuse material.
Detective Bruce stated that he entered the IP address into Maxmind, a publicly
available geolocation software, to identify the internet service provider. After determining
that the provider was Verizon, he subpoenaed Verizon for “customer/subscriber
information, including any listed addresses, telephone numbers, dates of birth, names,
addresses, and other customer identifying information” for the 220 IP address on “4-20-
2022 at 19:06:09 UTC[.]” Verizon produced documents, identified as State’s Exhibit 2,
which were certified by its custodian of records.
The State then sought to introduce the exhibit into evidence. Appellant objected,
arguing that an expert witness was required, and the court overruled the objection. The
Verizon records contained the following:
IP Address: 74.103.25.220 on requested date and time
Customer Information:
Vision Customer Id: 955853165 Vision Account Id: 0001 Customer Name: ADAM JUN Account Address: 503 DARLENE AV LITHICUM HEIGHTS, MD 210900000 Daytime Telephone 9016068145 Email Address: ajun1800@gmai1.com UserID: vzrpgmpmrah6
5 Detective Bruce acknowledged on cross-examination that there were other IP addresses included in the tip, but he confirmed that he focused on this IP address because the geolocation data showed that it was the only one within his jurisdiction.
4 UserName: ajun1800@gmail.com
Detective Bruce testified that he verified the home address, using the Verizon records and
records from the Motor Vehicle Administration. He testified that he served Kik with a
search warrant for electronic records associated with the Kik username “aj184888” and the
email address “ji44m@gmail.com.” The warrant requested “[b]asic subscriber data[,]” “IP
addresses[,]” “chat logs[,]” and “[a]ll images and videos” associated with the “aj184888”
account from “January 1, 2022 to July 5, 2022.” Detective Bruce did not physically visit
Kik’s address or assist in the collection of data. He stated that he did not know who,
specifically at Kik, collected the records or what protocols that person would have
followed. His communications were through the organization’s online portal.
In response to the search warrant, Kik provided two folders of documents: a
“contents” folder and a “logs” folder. A document within the contents folder certified that
the “records were prepared by Kik personnel or made and kept by Kik’s automated systems
in the regular course of business.” The State moved to introduce the Kik business records
into evidence, and Appellant objected, arguing that they were untrustworthy. The court
overruled his objection and admitted the documents as State’s Exhibits 1 and 7a-7i. 6
The contents folder contained child sexual abuse material and photos of Appellant,
his wife, and family friends. The folder also contained the subscriber data for the account.
The subscriber data listed “AJ Jones” as the name for the account, “74.103.25.220” as the
6 Parents of family friends identified non-CSAM pictures of their children at trial. Rachael Jun also identified pictures of herself and her husband, Appellant.
5 IP address for the account, and an “android” “model=SM-G996U” as the device and model
used to access the account.
The logs folder contained text files including “34 Chat Platform Sent Received” and
“33 Chat Platform Sent,” and these files were identified as State’s Exhibits 7j and 7k. Other
text files within the folder were redacted or encrypted and, as a result, Detective Bruce
testified that they were not included in the record. Kik attached a legend that gave
instructions on how to read the files:
Chat_platform_received.txt file - Individual chats received that include media messages HEADERS: Timestamp | User JID | Related User JID | App Name | Content ID | Date | Time
Chat_platform_sent.txt - Individual chats sent that include media/images HEADERS: Timestamp | User JID | Related User JID | App Name | Content ID | User IP | Date | Time
Detective Bruce explained that the text files connect the account for aj184888 and the 220
IP address with the images and videos of CSAM, 7 Appellant, his wife, and family friends.
The State called John Foster, a demonstrative evidence specialist in the Anne
Arundel County State’s Attorney’s Office, to testify about State’s Exhibits 8 and 9, which
mirrored State’s Exhibits 7j and 7k. Mr. Foster testified that he transferred the Kik text
files from the logs folder, State’s Exhibits 7j and 7k, into color coded Excel charts to create
State’s Exhibits 8 and 9. Mr. Foster stated that the demonstrative exhibits were formatted
to make them easier to read. The State moved to have the demonstrative exhibits admitted
7 Detective Bruce was able to identify the images and videos as CSAM because of his “training, knowledge, and experience in handling these cases[.]”
6 into evidence. Appellant had “no objection in terms of it as a demonstrative of an exhibit
that’s already in evidence” but did object “to its use without expert testimony in terms of
interpretation.” The court admitted the exhibits into evidence.
Detective Bruce returned to the stand to discuss child sexual abuse material trading.
He explained why people trade the images and he gave examples. He then linked the
information in the logs folders to the demonstrative exhibits. Appellant objected, arguing
the testimony required an expert, and the court overruled his objection.
To me, this is somewhat akin to as if the detective say . . . could read and write French. And but French was not his native language, And I think this will be very much open to cross whether or not the detective can read that or not . . . I don’t think you necessarily have to be an expert just because you might have a second language.
Detective Bruce then connected the videos and images from the contents folder to the text
files in the logs folder. Looking at the cells highlighted red in the demonstrative exhibits
for CSAM, Detective Bruce identified the senders, the recipients, and the file names that
contain CSAM. Detective Bruce confirmed “aj1848884_ypy” as a username in the logs
folder associated with both sending and receiving CSAM.
A video recording of Appellant’s interview with Detectives Bruce and Wood was
admitted and played while Detective Bruce was on the stand. Appellant acknowledged
that he lived at 503 Darlene Avenue from 2008 to September 2022, and that, while he lived
there, Verizon was his internet service provider. He also confirmed that he had a Kik
account, but he could not remember the username or email address for that account. He
denied using the name AJ Jones.
7 During the interview, the detectives asked Appellant about pictures of himself, and
his friend found in a Kik account and Appellant confirmed that he recognized the pictures.
The detectives then informed him that they had other content from a Kik account with
“underage material,” and he replied “Okay.” 8 Detective Bruce added “you know, teenagers
and kids in the prepubescent area, right, thirteen and up. And so I was able to verify that
from that account that you had, you had sent from your account to other people those files,
right?” The detective added “I can explain to you all the images that I initially got that
were initially reported and what I discovered but it’s all . . . underage material[.]” Appellant
explained, “Okay. I might have seen stuff like that before, not spend like time with it. You
said that instant regret type thing, you see something like this, it’s gross, it’s not like I had
my -- just deleted it. I don’t remember sharing stuff or -- I don’t know.”
Appellant told the detectives that he received the files on Kik. He stated that his
“life the last four years [had] been super depressing” and that he “was super lonely so
drinking and sometimes look[ing] at porn, so I don’t -- I really don’t remember
everything.” Appellant continued,
I know I’ve seen it, I don’t remember like how it initiated or where it went. I know they have like the chatrooms and so I would just look at the -- you know, what’s in Baltimore City like Baltimore Fun or -- you know, and then the conversations go from there, like people want to hook up, or talk about things, or something like that.
Detective Bruce explained that he “was only able upon [his] review to confirm that those
amount of images were just the ones that were clear cut child pornography or child
8 Detective Bruce admitted that he never showed Appellant the CSAM pictures from this case during the interview.
8 material.” Appellant replied, “Okay.” Later, the detectives told him that there was material
where an individual “could be 20 years old, but [] looks like she’s 16” “[b]ut with this
material, you can’t confuse” the ages, to which Appellant again replied, “Okay.” 9
During the interview, Appellant admitted to trading pornographic material. He
commented, “I have some [pornographic material] if you have a link. And I was like, oh,
here, just take this one.” When asked specifically about trading, he said “I did go through
like we vet it.” He stated that he only looked at pornographic material on his phone.
On cross-examination, Detective Bruce was questioned about the different kinds of
IP addresses and their relevant evidentiary significance. Appellant’s counsel asked if “a
layperson would understand” that the headers “User ID” and “Related User ID” in State’s
Exhibit 1 would correlate with a sender and a receiver for the files in State’s Exhibits 7j
and 7k. The detective replied that a layperson would not have the “training, knowledge, or
experience to know that.” Appellant’s counsel also questioned Detective Bruce on the
differences within the various Kik IP logs. Detective Bruce confirmed that one of Kik’s
IP logs did not have activity registered for the 220 IP address on May 2. 10
Following closing arguments, the court found Appellant guilty of eight counts for
distributing a visual representation of a minor engaged in sexual conduct and eight counts
for possessing a visual representation of a minor engaged in sexual conduct. Appellant
9 At the end of the interview, the detectives confiscated Appellant’s phone and found it to be the same model from the Kik records. They did not find any CSAM on the phone itself. 10 Appellant noted at trial that he filed a police report for identify theft months before the arrest.
9 was acquitted of the charges related to May 2, 2022. He was sentenced to eighty years in
prison with all but eighteen months suspended and five years of probation upon his release.
Appellant timely appealed.
STANDARD OF REVIEW
Evidentiary rulings are generally reviewed for an abuse of discretion. State v.
Galicia, 479 Md. 341, 389, cert. denied, 143 S. Ct. 491 (2022). The admissibility of
evidence is given no “special deference” when it involves a legal question. Johnson v.
State, 457 Md. 513, 530 (2018). For example, when a court permits a lay witness to testify
to matters requiring “expert testimony under Maryland Rule 5-702, the court commits legal
error and abuses its discretion.” Galicia, 479 Md. at 389 (quoting Johnson, 479 Md. at
530).
DISCUSSION
I. The court properly admitted testimony, documents, and demonstrative exhibits relating to IP addresses, Verizon and Kik records, and CSAM trading.
Appellant argues that Detective Bruce, relying on his training, knowledge, and
experience, provided expert testimony when he was not properly qualified as an expert.
Appellant argues that State v. Payne, 440 Md. 680 (2014), where a detective relied on his
expertise to “translate” records “into something a layperson can understand[,]” is
instructive. He contends that Detective Bruce utilized his expertise to explain the
evidentiary connection between IP addresses and business records and to explain the
significance of CSAM trading. According to Appellant, such testimony was beyond the
understanding of the average layperson. Appellant cites two out-of-state opinions,
10 Commonwealth v. Manivannan, 186 A.3d 472 (Pa. Sup. Ct. 2018), and People v. Garrison,
411 P.3d 270 (Colo. App. 2017), in support of his contention that expert testimony was
necessary. He argues that the court’s errors were not harmless, and reversal is required.
The State argues that Detective Bruce’s testimony was “within the range of
perception and understanding of the average layperson and did not require specialized
training or knowledge to be understood[.]” Relying on the recent Supreme Court of
Maryland opinions, State v. Galicia, 479 Md. 341, 389 (2022), and Freeman v. State, 487
Md. 420 (2024), the State posits that information pertaining to IP addresses is “common
knowledge in today’s world in which the general public is constantly accessing the internet
on a variety of devices.” The State contends that Detective Bruce “simply recited the data
from the Kik records into the record” which is allowed as lay witness testimony. In the
context of CSAM, trading is akin to baseball card trading. As such, an expert witness was
not necessary. The State argues that even if there was error in admitting the evidence into
the record, the error was harmless, and the decision of the court should be affirmed.
Under Maryland Rule 5-701,
If the witness is not testifying as an expert, the witness’s testimony in the form of opinions or inferences is limited to those opinions or inferences which are (1) rationally based on the perception of the witness and (2) helpful to a clear understanding of the witness's testimony or the determination of a fact in issue.
Expert testimony 11 is required “when the subject of the inference . . . is so particularly
related to some science or profession that it is beyond the ken of the average layman.”
11 Courts permit expert testimony under Maryland Rule 5-702 when “the testimony will assist the trier of fact to understand the evidence or to determine a fact in issue.” The
11 Galicia, 479 Md. at 389 (quoting Johnson, 457 Md. at 530). A trial court must consider
whether the testimony is “within the range of perception and understanding” of the average
person, not “whether the average person is already knowledgeable about a given subject[.]”
Id. at 394. When analyzed together, “Md. Rules 5-701 and 5-702 prohibit the admission
as ‘lay opinion’ of testimony based upon specialized knowledge, skill, experience, training
or education.” Ragland v. State, 385 Md. 706, 725 (2005). Payne, Johnson v. State, 457
Md. 513 (2018), Galicia, and Freeman are instructive.
In 2014, the Supreme Court examined, in Payne, whether a detective needed to be
qualified as an expert to testify about the defendants’ communications path based on phone
records and cell tower locations. 440 Md. at 684–90. At trial, the detective testified that
he sifted through thousands of pages of raw phone records and created “a single page
document and . . . a quarter-page exhibit[]” that removed “information that [the detective]
determined was redundant, extraneous, as well as identification numbers for the cell towers
associated with each entry for which he substituted his own derived geographical
coordinates.” Id. at 685–86. His testimony about the defendants’ communications path
placed them near the scene of the crime on the night of the incident. Id. at 684–90. It was
admitted over objection by the defense. Id. at 683. They were subsequently convicted. Id.
at 682.
rule states that in deciding when a court will admit expert testimony, it must determine “(1) whether the witness is qualified as an expert by knowledge, skill, experience, training, or education, (2) the appropriateness of expert testimony on the particular subject, and (3) whether a sufficient factual basis exists to support the expert testimony.” Md. Rule 5-702.
12 The Supreme Court, in reversing the convictions, held that the testimony was
improperly admitted into evidence. Id. at 700. The Court determined that the “string of
data unfamiliar to a layperson” in the Call Detail Records was “not decipherable based on
‘personal experience.’” Id. at 701. The detective relied on his “additional training and
experience” to determine “the communication path of each call.” Id. at 700–01. The
“intricacies” of the data and the training it required for the detective to identify the relevant
cell towers necessitated that the detective be qualified as an expert. Id. at 718.
In 2018, the Supreme Court decided Johnson. There, the State called a supervisor
from the Maryland Transit Authority to testify about one of its officer’s movements and
location based on GPS data collected from Pocket Cop, a GPS tracking device. 457 Md.
at 521. The lay witness corroborated the victim’s timeline concerning the alleged rape and
police misconduct charges by reading two entries from a GPS report into the record that
placed the officer at the scene of the crime. Id. at 525.
The Supreme Court noted that “GPS technology is pervasive and generally reliable”
and that the “technology is also familiar to the general public[.]” Id. at 530–31. The Court
further stated that “[a]lthough a user may not understand precisely how a GPS device
works, the same is true for other commonly used devices such as clocks” and that the
“general public has a common sense understanding of what information the device
conveys[.]” Id. at 531. As such, the Court held that the witness reading the GPS data from
the report did not need specialized knowledge or experience to testify. Id. at 532.
In 2022, the Supreme Court revisited the issue of expert testimony in Galicia. At
trial, Galicia’s defense centered on his contention that he was not a part of a charged murder
13 conspiracy, but rather, he was home watching a movie on his Xbox on the night of the
murder. 479 Md. at 352. The State’s case relied, in part, on “historical cell site analysis”
to connect Galicia to the crime. Id. An employee from Google testified as a lay witness
about Galicia’s search records and about how he could have turned off his location tracking
data on his personal device. Id. at 385–86. The testimony was presented to show why
there was a break in the tracking data that could have placed Galicia at the scene of the
crime around the time of the murder. Id. at 385. Galicia objected to the witness’s testimony
about the search records and location tracking data, and the court overruled his objection.
Id. at 385–86. Galicia was subsequently found guilty of murder. Id. at 352.
On appeal, Galicia argued that the Google employee’s testimony should not have
been admitted as lay witness testimony. Id. at 353. This Court held that an expert’s
testimony was not required for the search records, but that expert testimony was necessary
to explain how a cellphone user could turn off their location tracking data. Id. at 386–88
(describing the opinion from our court). We reversed Galicia’s convictions and ordered a
new trial. Id.
The Supreme Court of Maryland granted certiorari and reversed our Court’s holding
that expert testimony was necessary. Id. at 395. In considering whether expert testimony
was necessary to testify about location tracking data, the Court noted that “smartphones
have become ever more ubiquitous and the location tracking capabilities of those devices
and their applications (or ‘apps’) ever more familiar.” Id. at 392–93. The Court found,
While few could explain the technology used by phones and the network of towers and satellites with which they constantly communicate, the fact that they collect data about users’ habits, including location, is widely
14 understood: “A cell phone’s identification of its location is one of its essential virtues. A cell phone must be found by a service provider for it to be used as a phone.” There has been, and will continue to be, much debate over which aspects of this pervasive yet rapidly evolving technology are within the common knowledge. The question currently before us, however, concerns not so much the technology behind location tracking, but rather the understanding that a user may exercise some control over this feature and the data that it generates.
Id. at 393 (internal citation omitted). The Court stated that “the gap in the chronological
listing [was] obvious” and that “this case is plainly closer to the simple recitation of the
data exemplified in Johnson than it is to the interpretive process at issue in Payne.” Id.
The Supreme Court found that the witness’s statements were properly admitted as lay
witness testimony and that expert testimony was not necessary. Id. at 395.
Most recently, the Supreme Court analyzed in 2024 whether an expert was
necessary to testify about the meaning of “lick” and “sweet lick” in Freeman. A detective,
during his testimony, defined both “based on his experience in the Robbery Unit of the
Charles County Sheriff’s Department.” 487 Md. at 426. The defense objected and argued
that the detective needed to be an expert in criminal slang to testify about the meaning of
these terms. Id. The trial court allowed the lay testimony, and the defendant was ultimately
found guilty of murder and robbery, among other charges. Id. at 423.
The Supreme Court, in affirming the conviction, held that the nature of the
detective’s “opinion was not reliant on processes or methodology outside the ‘ken’ of a
layperson.” Id. at 438. The detective’s “knowledge was derived from his everyday
experience” and “was within the range of perception of a layperson.” Id. at 438–39. The
Court distinguished the “nontechnical” testimony from this case with the “breadth of
15 technical data being tailored down and interpreted into a consumable format based on
experience in the field” from Payne. Id. at 437.
Here, in our view, Detective Bruce’s testimony about IP addresses is within the
range of perception of the average layperson as it is similar to the supervisor’s testimony
in Johnson, the Google employee’s testimony in Galicia, and the detective’s testimony in
Freeman. In Johnson, the Court acknowledged that a layperson may not know how the
technology for a GPS device works, but they would understand that a GPS device can track
location and time. Johnson, 457 Md. at 531. In Galicia, the Court found that the Google
employee could testify that geolocation tracking data can be turned off on a device even if
the average person does not understand the science behind geolocation tracking data.
Galicia, 479 Md. at 392–93. In Freeman, the Court upheld lay witness testimony regarding
slang terms, even when the detective relied on his experience, because their meaning was
within the range of perception of the average layperson. Freeman, 487 Md. at 431, 437–
38.
Cellphone usage, internet usage, and social media usage are all simultaneously
becoming more widespread in our present culture. People may not know how these
technologies work, but they are capable of understanding much of the information that they
convey. As illustrated by Galicia, the question is not “whether the average person is
already knowledgeable about a given subject” but rather whether the testimony is “within
the range of perception and understanding.” Galicia, 479 Md. at 394. Even if people do
not know how an IP address is linked to a physical location, it is within the range of
16 perception and understanding of the average layperson that the internet provided by their
internet service provider allows them to use social media on their devices in their homes.
IP addresses can be readily found and the fact that IP addresses allow people to
connect to the internet through their internet service provider at a physical address is within
the ken of the average layperson. Internet service providers often attach a label or a sticker
with an IP address that can be found on a subscriber’s router. Moreover, people can use
their electronic devices to find their IP address.
In the present case, Detective Bruce testified that the 220 IP address connected to
Jun’s internet service provider, Verizon, was also connected to the Kik account with
CSAM. We hold that his testimony falls within the common understanding of the average
person who uses their phone, laptop, or tablet to connect to the internet from their home or
office every day.
Jun cites two out-of-state opinions, Manivannan and Garrison, to support his
argument that expert testimony is necessary to elaborate on a connection between IP
addresses and physical addresses. 12 Both opinions center on an analysis of how email
addresses were being accessed based on the IP addresses used to access them. The focus
of our State’s caselaw is on whether the information is “within the range of perception and
understanding” of the average person and not whether they already know the information.
12 Manivannan and Garrison analyze our unreported opinion from 2017, Ali v. State. In Ali, a lay witness testified about how IP addresses could be used to create an access history log for someone using an email. Maryland Rule 1-104 prevents us from considering unreported opinions from before 2023. As a result, we do not give Ali v. State any consideration within this opinion.
17 Galicia, 479 Md. at 394. The average person uses the internet and social media in some
form in their personal and professional lives. As it is within their range of understanding
that geolocation tracking data can be turned off when using Google, it is within their range
of understanding that internet users need an IP address to access social media and that an
IP address can be traced to a subscriber.
Likewise, Detective Bruce’s testimony about the trading of CSAM is not a subject
of a science or profession beyond the ken of the average layperson. The testimony reflected
the common meaning of the trading. He testified that people often trade CSAM to complete
collections or to collect files that they do not already have. Appellant confirmed, during
his interview, that a trade may appear like “I have some [pornographic material] if you
have a link. And I was like, oh, here, just take this one.”
Appellant points out that Detective Bruce relied on his knowledge and experience
to explain trading. However, simply because a witness testifies to his experience does not
mean that every statement made by the witness is an expert opinion. The detective in
Freeman testified about his experience and training in discussing the slang words “lick”
and “sweet lick.” The Supreme Court found that his testimony did not rely on scientific or
technical knowledge beyond the ken of the average layperson. Here, Detective Bruce’s
testimony about CSAM trading is equivalent to other forms of trading or barter that people
come across in their daily lives. CSAM trading is within the ken of the average layperson.
Expert testimony was not required in order to explain the Verizon or Kik records.
Detective Bruce read the exhibits into the record like the lay witnesses in Johnson and
Galicia. The witnesses in Johnson and Galicia did not have to perform extensive
18 interpretation or translate technical information based on specialized knowledge to read
data from their reports. See Johnson, 457 Md. at 532; Galicia, 479 Md. at 393. Detective
Bruce, likewise, recited information directly from the exhibits without relying on expert
interpretation. He stated Adam Jun was the customer name for the Verizon account at 503
Darlene Avenue based on the plainly stated information provided in the Verizon records.
He matched the IDs from the logs folder and the demonstrative exhibits with the CSAM in
the contents folder during his testimony. The records did omit redacted and encrypted files,
but this is not the thousands of pages of culling as seen in Payne. See Payne, 440 Md. at
700–01. The State had Detective Bruce confirm the data contained within the documents
and demonstrative exhibits, and he did so without using his police experience to narrow
data to a specific, expert conclusion.
Jun argues that it would not be apparent to the average layperson that User JID and
Related User JID from the Kik records correspond with a sender and a receiver, but a
common sense reading of the “34 Chat Platform Sent Received” and “33 Chat Platform
Sent” logs (State’s Exhibits 7j and 8 and State’s Exhibits 7k and 9) indicate that the logs
focused on messages received and messages sent. When looking at the individual logs, the
User ID for the “33 Chat Platform Sent” is “aj1848884_ypy” for each entry, and the Related
User ID varies, then, in the “34 Chat Platform Sent Received” vice-versa. A reading of the
Kik records with the legend would allow the average layperson to understand its contents.
In the present case, we hold that the Verizon and Kik records are “within the range
and perception” of an average layperson. As the internet has become more widespread,
the underlying facts here are within the common understanding of laypeople. Moreover,
19 the business records and the demonstrative exhibits are straightforward and could be read
directly in as evidence. As such, the facts of our case are more similar to the facts from
Johnson, Galicia, and Freeman than Payne.
II. The circuit court properly admitted the Kik Business Records.
Jun argues that the Kik records should be excluded because they are not trustworthy.
He offers four reasons. First, the records were prepared in anticipation of litigation.
Second, “the record is silent as to ‘how much reliance’ Kik placed on the records, because
no one from Kik testified.” Third, the records needed considerable interpretation. Fourth,
the Kik records were inconsistent.
The State counters that the Maryland Rules and caselaw support the court’s finding
that the records were trustworthy. The records were consistent and were certified by a
custodian from Kik who confirmed that “records were prepared by Kik personnel or made
and kept by Kik’s automated systems in the regular course of business.”
Maryland Rule 5-803(b)(6) is pertinent to our consideration of this issue. It states
that a document is not prohibited by the rule against hearsay if it meets the following
requirements:
(A) [I]t was made at or near the time of the act, event, or condition, or the rendition of the diagnosis, (B) it was made by a person with knowledge or from information transmitted by a person with knowledge, (C) it was made and kept in the course of a regularly conducted business activity, and (D) the regular practice of that business was to make and keep the memorandum, report, record, or data compilation.
Md. Rule 5-803(b)(6). If, however, “the source of information or the method or
circumstances of the preparation of the record indicate that the information in the record
20 lacks trustworthiness[,]” then it may be excluded. Id. To determine trustworthiness, a trial
court looks at several factors:
1) the purpose for which the record was prepared and any possible motive to falsify including whether the record’s use in prospective litigation was a motive for its preparation,
2) how routine or non-routine the record is and how much reliance the business places on the record for business purposes, and
3) where, as in the instant case, the record contains opinions and conclusions — how valid, speculative, or conjectural the opinions or conclusions are, as well as the need for interpretation or cross-examination to prevent misleading or confusing the trier of fact.
Owens-Illinois, Inc. v. Armstrong, 326 Md. 107, 115 (1992) (internal citations omitted).
Here, there is no indication or evidence in the records that they were created for
litigation. Instead, Kik’s custodian certified that the records were kept or made in their
regular course of business. The records did not include opinions or conclusions but
contained images and data records that could be read in a straightforward manner as there
was a legend provided to assist the reader of the data. Detective Bruce could read the data
from the logs folder to connect them with the images in the content folder without extensive
interpretation. Nothing about the source of the information, Kik, or the manner of its
preparation indicates untrustworthiness. Accordingly, the court correctly admitted the Kik
exhibits into the record.
CONCLUSION
The circuit court properly admitted lay witness testimony from Detective Bruce
regarding IP addresses, the Verizon and Kik records, as well as the testimony regarding
21 child abuse material trading. The business records obtained from Kik were properly
admitted as certified business records.
JUDGMENT OF THE CIRCUIT COURT FOR ANNE ARUNDEL COUNTY IS AFFIRMED; COSTS TO BE PAID BY APPELLANT.