People v. Schneider , 2024 IL App (4th) 230524-U ( 2024 )

NOTICE 2024 IL App (4th) 230524-UThis Order was filed under
FILED
NO. 4-23-0524 July 10, 2024
Supreme Court Rule 23 and is
Carla Bender
not precedent except in the
IN THE APPELLATE COURT 4th District Appellate
limited circumstances allowed Court, IL
under Rule 23(e)(1).
OF ILLINOIS
FOURTH DISTRICT
THE PEOPLE OF THE STATE OF ILLINOIS, ) Appeal from the
Plaintiff-Appellee, ) Circuit Court of
v. ) McLean County
MICHAEL D. SCHNEIDER, ) No. 21CF711
Defendant-Appellant. )
) Honorable
) William A. Yoder,
) Judge Presiding.
JUSTICE DOHERTY delivered the judgment of the court.
Justice Harris concurred in the judgment.
Justice Steigmann specially concurred in part and dissented in part.
ORDER
¶1 Held: The appellate court affirmed defendant’s sentence on 1 count, modified his
consecutive sentences on 11 counts by applying a statutory cap of 28 years, and
remanded the matter back to the trial court for resentencing on 3 counts.
¶2 In December 2022, defendant Michael Schneider entered a partially negotiated plea
of guilty to 15 Class 2 felony counts of possession of child pornography (720 ILCS 5/11-20.1(a)(6)
(West 2020)). In February 2023, the trial court conducted a sentencing hearing at which defendant
contended the maximum aggregate sentence was capped because all 15 counts to which he pleaded
guilty stemmed from a single course of conduct. The court disagreed and sentenced him to
consecutive sentences of 4 years in prison on each count, resulting in an aggregate sentence of 60
years in prison.
¶3 Defendant appeals, arguing that his 60-year aggregate sentence violated section 5-
8-4(f) of the Unified Code of Corrections (Code) (730 ILCS 5/5-8-4(f)(2) (West 2020)) because
his convictions for possession of child pornography all stemmed from one course of conduct and
are, therefore, subject to a statutory cap on his aggregate sentence. We hold that: (1) the trial court’s
finding that the offense in count 13 arose from a separate course of conduct from that giving rise
to the other charges is not against the manifest weight of the evidence; (2) the consecutive
sentences imposed on counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102 must be modified to
reflect that they are subject to a cumulative cap of 28 years’ imprisonment; and (3) the record does
not support the conclusion that counts 6, 8, and 17 stemmed from separate courses of conduct, so
we vacate the imposition of those sentences consecutively and remand the matter for resentencing.
¶4 I. BACKGROUND
¶5 A. The Charges
¶6 In July 2021, defendant was charged with a variety of offenses in two separate
cases. In McLean County case No. 21-CF-711, defendant was charged with 130 counts of
possession of child pornography, all Class 2 felonies (720 ILCS 5/11-20.1(a)(6) (West 2020)),
based on 130 photos and videos found in his possession on April 1, 2021. In McLean County case
No. 21-CF-712, defendant was charged with various sex crimes, including criminal sexual assault,
a Class 1 felony (id. § 11-1.20(a)(4)), and production of child pornography, a Class 1 felony (id.
§ 11-20.1(a)(1)(vii)), all of which involved L.M., defendant’s underage piano student. Both cases
were considered simultaneously by the trial court, but only case No. 21-CF-711 is at issue in this
appeal.
¶7 B. The Guilty Plea
¶8 In December 2022, defendant entered a guilty plea to (1) 15 counts of possession
of child pornography—namely, counts 6, 8, 13, 17, 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102
-2-
in case No. 21-CF-711—which did not include photos of L.M., (2) 1 count of production of child
pornography for taking a sexually explicit photograph of L.M., and (3) 2 counts of criminal sexual
assault of L.M. In exchange, the State agreed to dismiss all other counts against him in both cases
and to recommend a 20-year prison sentence in case No. 21-CF-712. Defendant’s guilty plea to
the 15 counts in case No. 21-CF-711 was an open plea.
¶9 At the guilty plea hearing, the trial court admonished defendant regarding the plea
agreement, charges, and ranges of punishment in case No. 21-CF-712. The court then admonished
defendant regarding case No. 21-CF-711, explaining that each offense was a Class 2 felony,
punishable by a minimum of three, or a maximum of seven, years in prison, to be served
consecutively. Further, the court stated that the offenses were all separate and distinct acts. The
court did not admonish defendant that he was eligible for extended-term sentencing, and the State
did not indicate that it was pursuing extended-term sentencing.
¶ 10 As the factual basis for defendant’s guilty plea in case No. 21-CF-712, the State
proffered that on multiple occasions, starting in 2017, defendant sexually assaulted L.M., who was
between 13 and 15 years old at the time, and also took sexually explicit photos of her.
¶ 11 As the factual basis for defendant’s guilty plea in case No. 21-CF-711, the State
proffered the following:
“Next, Your Honor, in regards to [case No.] 21 CF 711, if that case were to
proceed to trial, the State would provide sufficient evidence to show that the
Normal Police Department, after being notified by L.M. that her music teacher the
defendant *** had sexually abused her over a course of years and had disclosed
that they had exchanged illicit photographs, a search warrant was [obtained for]
that residence. On April 1st of 2021[,] in [the execution of] that search warrant[,]
-3-
22 items were seized including multiple electronic devices. One of those devices
was a flash drive belonging to the defendant. In that flash drive in a folder[,] which
was labeled holiday spectacular 2015, contained another folder that was labeled
show files. In the show files folder multiple images and videos of suspected child
pornography were identified.”
¶ 12 The State then described the content of each image and video relevant to
defendant’s guilty plea and stated that an expert had opined that the images and videos depicted
minor children.
¶ 13 The trial court accepted the factual bases and defendant’s guilty plea.
¶ 14 C. The Sentencing Hearing
¶ 15 In February 2023, the trial court conducted a sentencing hearing in case Nos. 21-
CF-711 and 21-CF-712, at which the court received, among other things, (1) a presentence
investigation report, (2) a sex offender evaluation, (3) the testimony of Detective Jason Wood,
(4) victim impact statements, and (5) the State’s exhibits.
¶ 16 People’s Exhibit 1 contained the 15 media files underlying the 15 counts of
possession of child pornography in case No. 21-CF-711. The files were located inside a folder that,
when opened, showed a list of the 15 files, which included the file names and fields labeled “Date
modified” and “Date created” for each file. People’s Exhibit 2 contained the photographs of L.M.
and correspondence between defendant and L.M. from May 2017 through September 2017.
Defendant stipulated to both of these exhibits being admitted into evidence.
¶ 17 1. The Sex Offender Evaluation
¶ 18 The sex offender evaluation contained the evaluator’s report of an interview with
defendant, during which he was asked about the flash drive containing the child pornography. The
-4-
report stated as follows:
“[Defendant] said that [L.M.] started sending him pictures of her trying on different
outfits. He admitted that he bought her alcohol and she then started to offer him
naked pictures of herself if he would continue to purchase the alcohol. He indicated
that he continued to buy alcohol for her, and she would send him the pictures. He
said that this was when he got interested in child pornography. He admitted that he
sought out and downloaded the material and saved it in a [flash] drive. He indicated
that he would masturbate to his material.”
¶ 19 2. Detective Jason Wood
¶ 20 Detective Jason Wood of the Normal Police Department testified that he
forensically examined a flash drive seized from defendant’s home on April 1, 2021. Wood utilized
a device which allowed him to read the contents of a flash drive without writing any new
information. This process created a “bit for bit” duplicate image of defendant’s flash drive.
¶ 21 Wood examined the metadata for a file titled “ESP732.MP4”, which was the image
that formed the basis of count 13 of case No. 21-CF-711. Wood testified that both the “created”
and “modified” dates for this image were February 24, 2017. Regarding what “created” and
“modified” meant, Wood gave a hypothetical example, stating, “So, the created date that was on
the computer was the day I put it on the computer. The date it was modified was the day that I
changed any data within that [file].” He explained that, unless some other source could show when
the item was stored on the flash drive, that the “created and modified” date of February 24, 2017,
showed that the item was “created and modified on [the flash drive] on or before that date.” Wood
did not discuss the evidence underlying the other 14 counts in case No. 21-CF-711.
¶ 22 Because the record does not provide a definition for “metadata,” we find the
-5-
following definition in 126 Am. Jur. 3d Proof of Facts 281 §§ 1, 4 (April 2024 Update) helpful.
“Metadata is data typically stored electronically that describes
characteristics of electronically stored information (ESI) and is found in different
places in different forms. Metadata can be supplied by software applications, users,
or a computer's file system. Metadata can describe how, when, and by whom ESI
was collected, created, accessed, modified, and how it is formatted.
***
File system metadata consists of logs and other logistical information
generated by an operating system to track the demographics (name, size, location,
usage, etc.) of the ESI and not embedded within but stored externally from the
ESI. Examples of file system metadata that is frequently requested in litigation
include the DateModified, DateAccessed, and DateCreated fields, known as MAC
dates or fields.”
¶ 23 3. The Parties’ Arguments
¶ 24 The State recommended the maximum sentence of 7 years on each count in case
No. 21-CF-711 and recommended 20 years in prison for the three counts in case No. 21-CF-712.
The State highlighted defendant’s statements in the sex offender evaluation that he became
addicted to child pornography after L.M. sent him topless photos of herself, which led to his later
seeking out the pornographic images of other minors that the police found on his flash drive. The
State asserted that defendant’s claim that he had acquired all of the files at the same time was not
credible because Wood’s testimony established that the files were last created or modified in
February 2017, while the photos of L.M. were from May 2017 through September 2017.
¶ 25 Defense counsel responded that L.M. had been defendant’s student for years prior
-6-
to 2017, which meant other photos could exist that were not in the record that would corroborate
defendant’s statements. He further pointed out that (1) all of the images were found on one flash
drive and that defendant was convicted of possessing them on April 1, 2021, and (2) Wood’s
testimony provided only the February 2017 date for a single file’s creation or last modification.
Citing section 5-8-4(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2020)), defense counsel
argued that because there was no evidence that the flash drive contained material acquired at
different times, the possession of the child pornography constituted a single course of conduct with
no substantial change in the criminal objective. Defense counsel asserted that because there was
only a single course of conduct, section 5-8-4(f)(2) capped the maximum allowable sentence.
¶ 26 The State replied that the Code allows each image to be charged as a single and
separate violation and requires consecutive sentences. The State further argued that defendant had
downloaded hundreds of images “over a period of time” and his “intent of possession was over
many months, if not years.”
¶ 27 4. Defendant’s Statement in Allocution
¶ 28 In allocation, defendant stated that he never sought out child pornography until
L.M. sent him photographs through Snapchat (a smartphone application for sending messages,
photos, and videos). He stated that L.M. sent him additional photos over time but eventually
stopped. He then struggled with his child pornography addiction, leading him to seek videos of
underage girls, which “resulted in acquiring the pictures that [he was] charged with possessing.”
Defendant alleged he downloaded the photos as one password protected “zip” file. He looked at
those photos once and never again.
¶ 29 5. The Sentence
¶ 30 After considering the evidence in mitigation and aggravation, the trial court noted
-7-
that defendant was “being sentenced on 18 very serious felony offenses; three Class 1 felony
offenses in 21-CF-712; and 15 Class 2 felony offenses in 21-CF-711.” The court then sentenced
defendant on those offenses as follows:
“The defendant *** possessed photographs of [L.M.] in sexual poses and
possessed numerous images of child pornography. He has pled guilty to one count
of photographing the victim in [case No. 21-CF-712] and/or possessing a
photograph of the victim and 15 counts of possession of child pornography [in case
No. 21-CF-711].
***
I find that the defendant’s statement in relation to a single download is not
credible. As it relates to testimony of Det. Wood, images at different—I think it
was metadata creation dates. And I believe that these images of child pornography
are not part of a single course of conduct without a change in the criminal conduct
of the—criminal nature of the conduct.
***
As it relates to the 15 counts in 21-CF-711, these are Counts 6, 8, 13, 17,
18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102, the Court, as I previously mentioned,
believes that these were all separate and distinct acts and part of a separate course
of conduct. And the Court believes that an appropriate sentence on each of those
counts is four years to be followed up by a period of mandatory supervised release
at three years to life.”
¶ 31 Accordingly, the trial court sentenced defendant to 15 consecutive four-year
sentences—an aggregate sentence of 60 years’ imprisonment—on the 15 counts of possession of
-8-
child pornography in case No. 21-CF-711.
¶ 32 D. The Motion to Reconsider
¶ 33 Defendant filed a motion to reconsider the sentence, realleging that the maximum
allowable sentence was 28 years because the 15 counts of possession of child pornography
constituted a single course of conduct. At a hearing on defendant’s motion, defendant argued that
(1) the State had charged only one date for the date of possession in all 15 counts, (2) the images
were all stored in a single location—namely, the flash drive, and (3) the images all appeared to
originate from the same source based on a watermark the images bore. Because nothing indicated
that the creation date of the images was different for any of the images and all the counts alleged
possession on April 1, 2021, defendant asserted that the offenses were part of a single course of
conduct with no change in the criminal objective.
¶ 34 Defendant asserted that his case was similar to People v. Thompson, 2022 IL App
(2d) 190950-U, in which the appellate court concluded that a 72-year aggregate sentence for
disseminating child pornography, a Class 1 felony (720 ILCS 5/11-20.1(a)(2) (West 2016)),
violated section 5-8-4(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2016)) because the acts of
sending multiple e-mails containing child pornography within a short time period constituted a
single course of conduct punishable by a maximum aggregate sentence of 60 years in prison.
¶ 35 The State responded that (1) the legislative history did not support defense
counsel’s argument and (2) the only evidence that the images were “downloaded with one single
click of a button was *** [d]efendant’s statement in allocution.” However, the State pointed out
that the sex offender evaluation was evidence the trial court could consider, and it showed that
defendant looked at child pornography on multiple occasions and was not truthful when he said
that he became addicted to child pornography only after L.M. sent him photos of herself. Wood’s
-9-
testimony showed that the media file on the flash drive was acquired at a time earlier than when
he received those photos from L.M. The State continued, “When looking at the images and the
videos of the metadata it is clear that these were downloaded on multiple different dates over
months and months and months of time, and so to suggest to the Court [otherwise] is
inappropriate.”
¶ 36 The trial court concluded that defendant’s possession of the images in the flash
drive was not a single course of conduct, explaining as follows:
“So the question is in the court’s mind was the course of conduct—would
the acts conducted or taken in a—a series of acts taken with the same mental or
accompanying mental state?
So, the Defendant has indicated his mental state at the time that he
downloaded many of the—he was alleged to have downloaded many of the child
pornographic images, that being the mental state of an addiction caused by the
victim sending him partially clothed or nude images.
But the image—there was testimony at the sentencing hearing that one of
the images at least pre-dated any images from the victim being sent to the
Defendant. And so it would naturally flow from that that there was a different
mental state that caused the downloading of that image and therefore by definition
not part of the same course of conduct. And as a result of that, regardless of whether
the legislature intended for these to all be mandatorily consecutive and with no
aggregate limitation—regardless of that under the argument presented pursuant to
statute that allows for an aggregate maximum of the two most—the maximum of
the two most serious charges that only applies where the offenses were committed
- 10 -
as part of a single course of conduct, and there is evidence in this case that that is
not the case, that there was not—these acts were not committed as part of a single
course of conduct during which there was no substantial change in the nature of the
criminal objective.
Therefore, the Court believes that it made the appropriate ruling at the time
of sentencing imposing mandatorily consecutive sentences on all of the counts in
[case No. 21-CF-711], and the motion to reduce the sentence or modify the sentence
is going to be denied.”
¶ 37 This appeal followed.
¶ 38 II. ANALYSIS
¶ 39 On appeal, defendant argues that his 60-year aggregate sentence violated section 5-
8-54(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2020)) because his convictions for
possession of child pornography all stemmed from a single course of conduct, thereby triggering
application of the statutory cap on the aggregate sentence.
¶ 40 A. Applicable Law—Cap on Mandatory Consecutive Sentences
¶ 41 The issues in this case all involve the proper application of different subsections of
section 5-8-4 of the Code, the first of which requires the imposition of consecutive sentences for
specified offenses. 730 ILCS 5/5-8-4(d) (West 2020). Here, defendant concedes that the Code
requires the imposition of consecutive sentences for all 15 offenses to which he pleaded guilty in
the instant case.
¶ 42 The second relevant subsection, section 5-8-4(f), is the one which provides for a
“cap” on the aggregate length of the consecutive sentences under certain circumstances:
“For sentences imposed under the law in effect on or after February 1, 1978, the
- 11 -
aggregate of consecutive sentences for offenses that were committed as part of a
single course of conduct during which there was no substantial change in the nature
of the criminal objective shall not exceed the sum of the maximum terms authorized
under Article 4.5 of Chapter V for the 2 most serious felonies involved, but no such
limitation shall apply for offenses that were not committed as part of a single course
of conduct during which there was no substantial change in the nature of the
criminal objective.” Id. § 5-8-4(f)(2).
“ ‘The test to be used in determining whether a particular offense is part of a single course of
conduct, during which there was no *** [substantial] change in the nature of the criminal objective,
is the independent motivation test; that is, were the defendant’s acts independently motivated?’ ”
People v. Wilder, 325 Ill. App. 3d 987, 1001 (2001). “If there was a substantial change in the nature
of the criminal objective, the defendant’s offenses are part of an ‘unrelated course of conduct.’ ”
Id.¶ 43 Here, there seems to be no suggestion that there was a substantial change in
defendant’s criminal objective across all 15 counts, i.e., to obtain and possess child pornography.
The question is whether, as the trial court found, each one of the 15 counts relates to a course of
conduct separate from the others, or whether some or all counts might relate to “a single course of
conduct.” 730 ILCS 5/5-8-4(f)(2) (West 2020).
¶ 44 B. The Trial Court’s Finding of No “Single Course of Conduct”
¶ 45 We begin our analysis by noting that the 15 illicit computer files at issue were all
found on a single device in defendant’s possession on a single date: April 1, 2021. In order to
construe defendant’s possession as separate acts (i.e., not a “single course of conduct”), it becomes
necessary to find in the record some basis to conclude that he possessed the files, or at least some
- 12 -
of them, at an earlier date.
¶ 46 The trial court found that defendant’s acquisition of the 15 files at issue was “not
part of a single course of conduct without a change in the *** criminal nature of the conduct.” The
court did not explicitly share its reasoning for this conclusion. The only possible basis in the record
for such a finding would be the testimony of detective Wood or the file metadata reflected in
People’s Exhibit 1. We find that the issues presented are not identical with respect to each of the
computer files at issue, so we examine the basis for the trial court’s findings as to three separate
groups: (1) the single video file supporting count 13; (2) the 11 image files; and (3) the 3 remaining
video files. We undertake our review with the understanding that whether a defendant’s actions
constitute a single course of conduct or are part of an unrelated course of conduct is a question of
fact for the trial court, and a reviewing court will defer to the trial court’s determination unless it
is against the manifest weight of the evidence. People v. Robinson, 2015 IL App (1st) 130837,
¶ 102. “A finding is against the manifest weight of the evidence only if the opposite conclusion is
clearly evident or if the finding itself is unreasonable, arbitrary, or not based on the evidence
presented.” People v. Deleon, 227 Ill. 2d 322, 332 (2008).
¶ 47 1. The Video File—Count 13
¶ 48 At the sentencing hearing, the State called Detective Wood to provide his technical
interpretation of the metadata retrieved from the files on defendant’s flash drive. However, Wood
offered an opinion as to only one of the 15 files at issue, the video file relating to count 13 of the
indictment. The State asked Wood about both the “Date created” and “Date modified” information
for this file, and his answer suggested that the date reflected for each was the same: February 24,
2017. He then opined that this information meant that the file “was created and modified” on
defendant’s flash drive “on or before” February 24, 2017.
- 13 -
¶ 49 There were other questions not asked of Wood, such whether the “Date modified”
corresponding to each file could have been “inherited” (i.e., whether the date was imprinted on the
file before defendant obtained it). He was not asked what effect downloading the files via a “zip”
file would have had on the dates contained in the metadata. Finally, he was also not asked the
significance of the “Media created” date listed in the metadata for only one file, the video file
relating to count 8. Regardless, it is clear enough that Wood’s testimony was sufficient to support
the trial court’s implicit conclusion that defendant first obtained the video file relating to count 13
“on or before” February 24, 2017, i.e., prior to the April 1, 2021, date on which all 15 files were
seized. At least as to the file relating to count 13, this is sufficient to support the court’s conclusion
that defendant’s possession of that file is not part of a “single course of conduct” that includes the
other 14 files at issue.
¶ 50 2. The 11 Image Files
¶ 51 As noted above, the 11 image files were seized from defendant on April 1, 2021.
Absent evidence that individual files within that group of 11 were acquired on a different date or
dates, one would have to conclude that the offenses arising from possession of these files were part
of a “single course of conduct” that occurred on April 1, 2021.
¶ 52 Stated more succinctly, the dates stored in the computer file metadata of a
photograph or video on a flash drive may reflect the actions of the possessor of the flash drive,
while other dates may reflect actions taken by different people that affected the file; a key question
will often be whether a date contained in metadata reflects the former or the latter. Courts should
not assume that they are capable of deciphering the meaning of computer file metadata without
appropriate expertise or stipulations.
¶ 53 Perhaps Detective Wood, if asked, could have provided a competent interpretation
- 14 -
of the metadata on the 11 image files in question and the conclusions that might be drawn about
the date of defendant’s original possession of these files. All that was available to the trial court,
however, was the metadata information found in People’s Exhibit 1, the entirety of which is
summarized in the following chart:
Count Date Created Date Modified Media Created
----- MP4 / Windows Media Files / Videos -----
6 2/17/2023 (11:32 a.m.) 2/2/2016 (10:54 a.m.)
8 2/17/2023 (11:34 a.m.) 9/17/2014 (11:28 p.m.) 9/17/2014 (3:28 p.m.)
13 2/17/2023 (11:34 a.m.) 2/24/2017 (10:17 p.m.)
17 2/17/2023 (11:34 a.m.) 8/5/2017 (9:59 p.m.)
----- JPG Files / Images -----
18 2/17/2023 (11:35 a.m.) 10/22/2019 (11:52 p.m.)
27 2/17/2023 (11:35 a.m.) 10/22/2019 (11:58 p.m.)
48 2/17/2023 (11:32 a.m.) 10/23/2019 (12:03 a.m.)
53 2/17/2023 (11:32 a.m.) 10/23/2019 (12:05 a.m.)
60 2/17/2023 (11:32 a.m.) 10/23/2019 (12:05 a.m.)
67 2/17/2023 (11:32 a.m.) 10/22/2019 (11:54 p.m.)
68 2/17/2023 (11:32 a.m.) 10/22/2019 (11:55 p.m.)
74 2/17/2023 (11:32 a.m.) 10/23/2019 (12:04 a.m.)
85 2/17/2023 (11:32 a.m.) 10/23/2019 (12:04 a.m.)
94 2/17/2023 (11:32 a.m.) 10/22/2019 (11:59 p.m.)
102 2/17/2023 (11:32 a.m.) 10/23/2019 (12:03 a.m.)
¶ 54 With no training or expertise in the interpretation of this information, an observer
might draw mistaken conclusions from a literal interpretation of the column headings. Does “Date
- 15 -
created” mean the date on which the file first came into existence, its genesis? We know this cannot
be true, because here the “Date created” falls nearly two years after the material was seized from
defendant. Does “Date modified” mean the date on which defendant changed the content of the
file in some way? There is no allegation in the record that he did so. The inability to understand
the meaning of the dates reflected in the metadata demonstrates the need for appropriate expert
assistance, yet none was elicited from Wood on 14 of the 15 files.
¶ 55 Moreover, it is not possible to extrapolate Wood’s testimony with respect to the file
in count 13 so as to interpret the metadata from the 11 image files. The reason is that Wood’s
opinion concerning the video file at issue in count 13 was based on his awareness of two fields of
metadata for that file: both the “Date modified” and “Date created” fields. The only information
available to the trial court—and to us—is the “Date modified” field on People’s Exhibit 1. But
People’s Exhibit 1 is a copy of a copy; the “Date created” field was apparently overwritten in the
process of creating the DVD introduced into evidence. While the first copy of defendant’s flash
drive was made carefully by Wood with special equipment to ensure that none of the metadata was
overwritten, the DVD entered as People’s Exhibit 1 apparently was not. As noted above, Wood’s
interpretation of the metadata for the file correlating to count 3 was based on his knowledge of
matching information contained in both fields on defendant’s flash drive. Wood never testified
that the download date could be inferred from the “Date modified” field alone, i.e., the only
meaningful metadata field on People’s Exhibit 1. As it involved conclusions drawn from two fields
of metadata, Wood’s methodology was not susceptible to being extrapolated by the trial court,
which had just one. There is, then, no basis on which to find that these 11 files were obtained by
defendant via separate courses of conduct on any date other than April 1, 2021.
¶ 56 We note that, while we believe it would be a mistake to attempt to interpret the
- 16 -
metadata from the relevant files ourselves, doing so would lead to the same conclusion about the
fact that the 11 files were obtained in a “single course of conduct.” The reason is that the “Date
modified” metadata fields for these 11 files reflect dates and times falling within 13 minutes of
each other. Consequently, even if these metadata dates were treated as the moment of defendant’s
acquisition, it would be unsupportable to characterize each of these downloads as a course of
conduct separate from the other 10.
¶ 57 In Thompson, the defendant was found guilty of 12 counts of unlawfully
disseminating child pornography after he sent four e-mails containing multiple lewd images to a
single individual during an e-mail exchange lasting less than 90 minutes. Thompson, 2022 IL App
(2d) 190950-U, ¶¶ 2, 42. On appeal, the appellate court concluded that the trial court’s finding that
the four e-mails did not constitute a “single course of conduct” was against the manifest weight of
the evidence. Id. ¶ 42. The same conclusion would be even more clearly appropriate here, where
the metadata evidence before the trial court, even if taken at face value, could at most support a
finding that all 11 files were obtained over the course of 13 minutes.
¶ 58 3. The Three Remaining Video Files
¶ 59 The question now turns to whether the record supports the trial court’s conclusion
that defendant’s acquisition of the three video files not discussed by Detective Wood constitute
three separate and independent courses of conduct. Again, it is fair to treat the default date of
possession as being April 1, 2021, absent competent evidence of a different date. The only other
available information is the file metadata. As reflected in the table above, the “Date modified”
field for the three video files relating to counts 6, 8, and 17 bears the following dates, respectively:
February 2, 2016; September 17, 2014; and August 5, 2017. Recall that Wood testified that
defendant obtained the file at issue in count 13 on or before February 24, 2017.
- 17 -
¶ 60 For the same reasons discussed above with respect to the 11 image files, we
conclude that the file metadata does not on its face support the conclusion that these 3 video files
were obtained by defendant on three separate dates between 2014 and 2017. Still, it is important
that these three video files not be considered in isolation; their relationship to the first date of
possession of other files may impact defendant’s sentence. For example, if the 3 video files
pertaining to counts 6, 8, and 17 were obtained by defendant at the same time he obtained the 11
image files, they would constitute a single course of conduct; in that case, his sentence on all 14
counts would be subject to the same 28-year cap.
¶ 61 C. The Effect on Defendant’s Sentence
¶ 62 Having reached conclusions about what the record supports with respect to whether
defendant’s offenses constitute separate courses of conduct, there is one additional legal issue to
be addressed before the effect of these conclusions on defendant’s sentence can be ascertained.
¶ 63 1. The Maximum Aggregate Sentence for a Single Course of Conduct
¶ 64 Defendant contends that the maximum term in prison to which he can be sentenced
for a single course of conduct is 14 years based on the maximum nonextended-term prison sentence
of 7 years because (1) the record does not show he was extended-term eligible and (2) “to include
the maximum extended term sentence, in a case where the defendant is not otherwise eligible for
an extended term, amounts to an unconstitutional end-run around the requirements of Apprendi [v.
New Jersey, 530 U.S. 466 (2000)], and Illinois law.”
¶ 65 Although we agree with defendant that the record does not show he was extended-
term eligible, we disagree with defendant’s contention that his extended-term eligibility has any
bearing on the maximum aggregate sentence he could receive under section 5-8-4(f)(2) of the
Code. Consistent with Apprendi, 530 U.S. at 490, Illinois law requires that “whenever a fact other
- 18 -
than a prior conviction is considered to enhance a penalty beyond the statutory maximum, that fact
must be found to exist beyond a reasonable doubt by the trier of fact.” People v. Mimes, 2014 IL
App (1st) 082747-B, ¶ 26.
¶ 66 Defendant concedes “[t]here are cases holding that the maximum aggregate
sentence was based on the maximum extended term for the class of felony” (see People v. Pullen,
192 Ill. 2d 36, 46 (2000); People v. Woods, 131 Ill. App. 3d 51, 55 (1985); People v. Beck, 190 Ill.
App. 3d 748, 763 (1989); People v. Myrieckes, 315 Ill. App. 3d 478, 482 (2000)), but he argues
that because those cases predated Apprendi and subsequent changes to the Code, the maximum
aggregate sentence should not be calculated using the authorized extended-term sentence for Class
2 felonies. However, beyond the mere assertion that the legal landscape is now different, defendant
does not explain why the Apprendi decision affects the section 5-8-4(f)(2) calculation. Further, the
State points out that Thompson, which defendant cites favorably, calculated the maximum
aggregate sentence using the maximum extended-term sentence, even though the sentencing court
did not find that the defendant in Thompson was eligible for an extended-term sentence. See
Thompson, 2022 IL App (2d) 190950-U, ¶ 35 (citing Myrieckes, 315 Ill. App. 3d at 482).
¶ 67 In People v. Wagener, 196 Ill. 2d 269, 286 (2001), the Illinois Supreme Court
rejected a similar argument that the imposition of consecutive sentences pursuant to section 5-8-
4(b) of the Code was unconstitutional because it violated Apprendi. The court concluded as
follows:
“We find that Apprendi concerns are not implicated by consecutive
sentencing. It is a settled rule in this state that sentences which run consecutively to
each other are not transmuted thereby into a single sentence. [Citations.] Because
consecutive sentences remain discrete, a determination that sentences are to be
- 19 -
served consecutively cannot run afoul of Apprendi, which only addresses sentences
for individual crimes. Accordingly, section 5-8-4(b) of the Code passes
constitutional muster.” Id.¶ 68 As in Wagener, the present case does not concern an increase to defendant’s
individual sentences. Instead, section 5-8-4(f)(2) is a statutorily imposed limit on the total length
of time defendant can serve on his mandatory consecutive sentences. See Pullen, 192 Ill. 2d at 45(“[T]he aim of section 5-8-4(c)(2) of the Code [(730 ILCS 5-8-4(c)(2) (West 1994))], and statutes
like it, is to limit the total length of consecutive sentences imposed on a defendant, while still fairly
punishing the defendant in relation to the severity of the crimes.” (Internal quotation marks
omitted.)). Because a determination of whether defendant will be subjected to consecutive
sentencing does not violate Apprendi, we see no reason why section 5-8-4(f)(2)’s limit on the total
length of a defendant’s sentence would operate differently. Accordingly, we calculate the
maximum aggregate prison sentence that defendant can serve for a single course of conduct based
on the maximum authorized extended-term sentence.
¶ 69 2. Calculating Defendant’s Sentence
¶ 70 We begin by addressing the sentence imposed on count 13. We have upheld the
trial court’s implicit finding that defendant’s possession of the material at issue in this charge
occurred on or before February 24, 2017, and that it is the result of a course of conduct separate
from any of the 14 other charges. Consequently, we affirm the trial court’s sentence of four years’
imprisonment imposed on count 13, to run consecutively to the remaining counts.
¶ 71 We have also concluded, however, that the trial court’s finding of separate courses
of conduct is unsustainable when it comes to the charges related to defendant’s possession of the
11 image files as charged in counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102. Because the two
- 20 -
most serious felonies involved in this case are Class 2 felonies (possession of child pornography),
the maximum aggregate sentence for offenses that were part of a single course of conduct is 28
years in prison—twice the 14-year maximum for an extended-term sentence. See 720 ILCS 5/11-
20.1(c-5) (West 2020); 730 ILCS 5/5-4.5-35(a) (West 2020); Pullen, 192 Ill. 2d at 43 (concluding
the maximum aggregate sentence for two Class 2 felonies was 28 years in prison). Consequently,
we honor the statutory cap on consecutive sentences. Pursuant to our authority under Illinois
Supreme Court Rule 615(b)(4) (eff. Jan 1, 1967), we reduce defendant’s aggregate sentence on
these 11 charges to 28 years’ imprisonment. Because the record supports the conclusion that there
were years between defendant’s acquisition of the 11 image files and the single video file at issue
in count 13, the four-year sentence on the latter runs consecutively to the 28-year aggregate
sentence on the former.
¶ 72 Finally, we have determined that the trial court’s finding that the offenses relating
to the three video files at issue in counts 6, 8, and 17 constitute separate courses of conduct is
against the manifest weight of the evidence. We hesitate, however, to bundle these offenses into
the same course of conduct as the 11 image file possession charges—a conclusion that would bring
these charges under the existing 28-year cap—because such a conclusion is also not clearly
supported by the evidence. We are cognizant of the fact that, with appropriate expert interpretation,
the basis for finding that the actions at issue in counts 6, 8, and 17 were separate courses of conduct
may already be present within the metadata found in People’s Exhibit 1. In other words, unlike the
11 image possession counts, the metadata leaves the door open to the possibility that the three
video files were obtained by defendant on separate dates.
¶ 73 Reviewing courts must exercise cautiously their authority under Rule 615 to reduce
a defendant’s sentence. People v. Jones, 168 Ill. 2d 367, 378 (1995). Among the considerations in
- 21 -
deciding whether to remand for resentencing is whether the parties may have “new or additional
evidence to offer upon remand.” Id. “A remand to the trial court affords the parties the opportunity
to present new or additional evidence.” People v. Quevedo, 403 Ill. App. 3d 282, 300 (2010). Here,
for example, the parties may wish to offer additional expert testimony concerning the conclusions
which can be drawn from the pertinent file metadata with respect to defendant’s original dates of
possession.
¶ 74 For this reason, we feel that the appropriate disposition with respect to counts 6, 8,
and 17 is to vacate the trial court’s imposition of consecutive sentences on these three counts and
remand solely for the purpose of addressing whether the consecutive sentences are subject to the
same 28-year cap applicable to the 11 image file counts. This will require the trial court to
determine whether any of the 3 video files constituted courses of conduct separate from
defendant’s April 1, 2021, possession of the 11 image files; if any are found to be separate courses
of conduct, the trial court’s four-year sentence on any such count would be made consecutive to
the sentences on the other counts without limitation. If, however, possession of any of these 3 files
is found to be the result of the same course of conduct which led to defendant’s possession of the
11 image files, the overall sentence for those counts would be subject to the same 28-year cap
applicable to the 11 image files (i.e., defendant would receive no additional years of incarceration
on such counts). Defendant’s aggregate sentence will be either 32, 36, 40, or 44 years, depending
on whether the trial court finds none, 1, 2, or all 3 of the 3 video files are subject to the same 28-
year cap applicable to the 11 image file counts. The trial court should then issue a corrected
mittimus accurately reflecting defendant’s aggregate sentence.
¶ 75 III. CONCLUSION
¶ 76 For the reasons stated, we affirm defendant’s four-year sentence on count 13; we
- 22 -
modify defendant’s consecutive sentences on counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102
to an aggregate sentence of 28 years’ imprisonment (consecutive to the sentence on count 13); and
we vacate the imposition of consecutive sentences on counts 6, 8, and 17 and remand the cause for
the trial court to address whether the sentences on any of those 3 counts is subject to the same 28-
year cap that applies to the 11 image file counts.
¶ 77 Affirmed in part, modified in part, and vacated in part; cause remanded with
directions.
¶ 78 JUSTICE STEIGMANN, specially concurring in part and dissenting in part:
¶ 79 I concur in the majority’s disposition in two respects. First, I agree that the
consecutive sentences imposed on the 11 counts based on possession of illicit image files (counts
18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102) are properly capped at a total of 28 years. Second,
I agree with the majority that the record supports the trial court’s conclusion that count 13, based
on possession of an illicit video file, is not part of the same “single course of conduct” as the
previously mentioned 11 counts.
¶ 80 I respectfully disagree, however, with the conclusion of my distinguished
colleagues that the record does not support separate course-of-conduct findings for counts 6, 7,
and 17. In addition, notwithstanding my disagreement with their conclusion regarding the number
of separate courses of conduct supported by the record, I disagree with their decision to remand
the case for the presentation of additional evidence as to only counts 6, 7, and 17.
¶ 81 A. The Evidence
¶ 82 I view Wood’s testimony to have adequately apprised the trial court (and this court
for that matter) of the significance of the dates in People’s Exhibit 1—specifically, the dates listed
in the “Date modified” field (hereinafter modified dates) and “Date created” field (hereinafter
- 23 -
created dates). Wood testified that the “created and modified date” for the count 13 video was
February 24, 2017, which meant it was “created and modified on [the flash drive] on or before that
date.” He then explained what “created” and “modified” meant, in part, by way of the following
example:
“So, I will use a picture, for example. If I take a picture, it is going to have
a created, modified and last access date. If I crop that image on the same day I
created it, I have modified that image, so the stamp will be different. So, if I take a
picture of myself, for example, and I put it on my computer, it will have created a
modified access. Tomorrow, I go into it and I crop it, the image is still there, but it
has been modified. And it was modified the following day. So, the created date that
was on the computer was the day I put it on the computer. The date it was modified
was the day that I changed any data within that artifact.”
¶ 83 Wood’s testimony means that the modified dates correspond to the last time a file
was modified on the flash drive. Regarding the count 13 video file in People’s Exhibit 1, he also
testified that the modified date and created date—the date the file came into existence on the flash
drive—was February 24, 2017. I note that Wood’s testimony was not that “defendant created and
modified the file” on the device on or before that date; instead, he testified, “So the best I can tell
you is that item of evidence was created and modified on that device on or before that date.”
Accordingly, the trial court had to infer, based on the totality of the evidence and circumstances
known to it, whether defendant was the person who modified and created the count 13 file in the
flash drive on or before that date. In other words, was that date the earliest known date of
possession? The operative inference being as follows: If defendant modified the file on a certain
date, then he possessed the file on that date.
- 24 -
¶ 84 The record shows that (1) the 15 files were located in defendant’s flash drive, which
he admits he had for at least some amount of time prior to April 1, 2021; (2) the files were stored
in the flash drive along with hundreds of other files containing child pornography; (3) defendant
stated that he had struggled for years with his addiction to child pornography and sought out videos
of underage girls; (4) he stated that his addiction culminated in his downloading of “the pictures
that [he was] charged with possessing” as a single download, after he stopped receiving photos
from L.M.; (5) he stated that when he downloaded the pictures, he “was shocked and disgusted”
“[and] promptly exited the file ***. And [he] did not view and go into that folder again”; (6) he
stated that he would masturbate to child pornography; and (7) the victim stated that she was
groomed by defendant since she was 13 years old.
¶ 85 This evidence supports the inference that the modified dates for the 15 files in
People’s Exhibit 1 correspond to the dates defendant gained possession of those files.
¶ 86 Starting with the 11 image files, People’s Exhibit 1 shows that the 11 image files
have modified dates of October 22-23, 2019, and were modified over a period of 13 minutes. Those
times and dates comport with defendant’s statement in allocution that he downloaded “the pictures
that [he was] charged with possessing” as one file after he stopped receiving photos from L.M.
Importantly, those 11 image files are the only “pictures” that defendant was charged with
possessing and are the only files in People’s Exhibit 1 that show a modified date after defendant’s
and L.M.’s correspondence from May 2017 through September 2017 (supra ¶ 16).
¶ 87 The remaining four files in People’s Exhibit 1 are all video files that have modified
dates of September 2014, February 2016, February 2017, and August 2017, which again comports
with the record. L.M. was born in June 2002, meaning the pornographic photos of her that
defendant received from May 2017 through September 2017 were taken when she was 14 and 15
- 25 -
years old. She stated that his “grooming” of her began when she was 13 years old, almost two
years earlier than when those photos were taken. Clearly, defendant’s sexual interest in underage
girls began years earlier than 2017, based on his predation of L.M. alone.
¶ 88 Accepting as true defendant’s claim that he did not again open the folder on the
flash drive that contained the 11 photos after downloading them, his statements that he sought out
videos of child pornography, masturbated to child pornography, and struggled for years with the
addiction line up with the modified dates in People’s Exhibit 1, which range from 2014 to 2019.
Those files happen to be video files, which defendant said he had sought out. Also, considering
the volume of pornographic material in the flash drive and defendant’s tacit admission that he
possessed the files for some time prior to April 1, 2021, the trial court—at the very least—could
reasonably infer that the five different modified dates in People’s Exhibit 1 show five separate
courses of conduct.
¶ 89 Accordingly, I would affirm the trial court’s order and modify the sentence to
reflect those five separate courses of conduct. This would mean that defendant’s sentence would
become 44 years in prison, as I explain in my conclusion (infra ¶ 97).
¶ 90 B. Remand
¶ 91 In addition, because I agree with the majority that “it is fair to treat the default date
of possession as being April 1, 2021, absent competent evidence of a different date” (supra ¶ 59),
I believe that this case should not be remanded for additional evidence on only counts 6, 7, and 17.
In keeping with the majority’s conclusions about the evidentiary value of the metadata, on remand,
we should also permit additional evidence pertaining to the 11 counts based on possession of illicit
image files.
¶ 92 If, as the majority appears to indicate, the only reasonable conclusion about the
- 26 -
evidence to draw from Wood’s testimony is that the count 13 video file was downloaded at an
earlier date than the remaining 14 files, then those 14 files should be treated similarly to one
another. In other words, because the modified dates in People’s Exhibit 1 do not matter, there is
no basis for this court to conclude that possession of those 14 files was not part of the same
“default” course of conduct on April 1, 2021.
¶ 93 The majority concludes,
“As [Wood’s testimony] involved conclusions drawn from two fields of metadata,
Wood’s methodology was not susceptible to being extrapolated by the trial court,
which had just one. There is, then, no basis on which to find that these 11 files were
obtained by defendant via separate courses of conduct on any date other than April
1, 2021.” (Emphasis omitted.) Supra ¶ 55.
¶ 94 Despite that conclusion, the majority appears to extrapolate from Wood’s testimony
and the metadata a holding that the 11 image files are part of a single course of conduct. The
majority then, without explanation, singles out the counts 6, 8, and 17 video files as potentially
being part of separate courses of conduct. This distinction seems wholly at odds with the logic of
their decision.
¶ 95 The only reason I see for the distinction is that the majority presupposes that
additional evidence on those counts would confirm what the modified dates in People’s Exhibit 1
shows: The images were downloaded as a single course of conduct because they were downloaded
over a 13-minute period of time (supra ¶ 57). See Thompson, 2022 IL App (2d) 190950-U, ¶ 42.
However, the reasoning in the majority’s disposition is contrary to that presupposition. If taken as
true that the trial court or this court is unable to discern the meaning of the metadata from Wood’s
testimony (a point with which I strongly disagree), then the metadata for all the remaining 14
- 27 -
counts should be of no consequence to this court’s decision.
¶ 96 C. Conclusion
¶ 97 The foregoing analysis leads me to the following conclusions about defendant’s
appropriate sentence. First, with respect to the 11 charges related to possession of illicit images
(counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102), I concur with the majority that defendant’s
consecutive sentences for these offenses are capped at 28 years. Second, Wood’s testimony,
defendant’s testimony, People’s Exhibit 1, and the circumstances of defendant’s possession
provide a basis for the trial court to have concluded that the charges reflected in counts 6, 7, 13,
and 17 were part of separate courses of conduct from one another and the 11 image-possession
offenses. Accordingly, I would modify defendant’s aggregate sentence to 44 years in prison to
reflect the offenses’ having been committed as five separate courses of conduct—4 years in prison
each for counts 6, 7, 13, and 17, to be served consecutively to the 28-year maximum aggregate
sentence for the remaining 11 counts.
- 28 -