People v. Cervantes-Diaz

Opinion

NOTICE: This order was filed under Supreme Court Rule 23 and is not precedent except in the limited circumstances allowed under Rule 23(e)(1).

2026 IL App (3d) 240463-UB

Order filed June 9, 2026 ____________________________________________________________________________

IN THE

APPELLATE COURT OF ILLINOIS

THIRD DISTRICT

THE PEOPLE OF THE STATE OF ) Appeal from the Circuit Court ILLINOIS, ) of the 12th Judicial Circuit, ) Will County, Illinois, Plaintiff-Appellee, ) ) Appeal No. 3-24-0463 v. ) Circuit No. 21-CF-1527 ) JOSE RAMON CERVANTES-DIAZ, ) Honorable ) Carmen J. Goodman, Defendant-Appellant. ) Judge, Presiding. ____________________________________________________________________________

JUSTICE DAVENPORT delivered the judgment of the court. Presiding Justice Hettel and Justice Bertani concurred in the judgment. ____________________________________________________________________________

ORDER

¶1 Held: The simultaneous possession of multiple instances of child sexual abuse material can sustain multiple convictions; defendant waived the trial court’s ruling on his motion for directed finding and forfeited his speedy-trial contention; the trial court did not abuse its discretion in excluding evidence. Affirmed.

¶2 After a bench trial, defendant, Jose Ramon Cervantes-Diaz, was found guilty of three

counts of child pornography (hereinafter referred to as child sexual abuse material (CSAM) 1) (720

1 On January 1, 2026, the legislature changed all references in Illinois statutes from “child pornography” to “child sexual abuse material.” Pub. Act 104-245, § 50 (eff. Jan. 1, 2026) (amending 720 ILCS 5/11-20.1(a)(6) (West 2022)), predicated on three digital images found in defendant’s cell

phone. We affirm.

¶3 I. BACKGROUND

¶4 In October 2021, defendant was taken into custody on charges of CSAM possession. The

following month, a grand jury indicted defendant on three counts, each charging him with

knowingly possessing, on a cell phone, a CSAM image depicting a child under the age of 13. The

bill of indictment identified each image by a distinct 32-character alphanumeric “MD5 hash.”

¶5 In July 2023, defendant moved to dismiss, arguing he was the victim of hacking and the

State presented no evidence the inculpatory images were stored on defendant’s personal device,

“only that they were disseminated and electronically vaguely accessed by [an] electronic device

they believe to be [defendant’s].” Defendant attached his Boost Mobile phone records and a 2021

news article titled, “T-Mobile reaches $500M settlement in data breach.” The State moved to strike

defendant’s motion. Finding that defendant’s motion went to the merits of the case, the trial court

granted the State’s motion.

¶6 On November 21, 2023, defendant moved for pretrial release and filed a speedy-trial

demand. Defendant was granted pretrial release the same day, and the matter was set for trial.

¶7 A. Bench Trial

¶8 The court conducted a bench trial on April 30 and May 1, 2024.

¶9 1. State’s Case-in-Chief

¶ 10 The State called three witnesses, all affiliated with a CSAM investigation conducted by

Homeland Security Investigations (HSI): Jennifer Finerty, Jose Castaneda, and Terrance McCabe.

ILCS 5/11-20.1(a)). The name change is not a change in the law, but a reflection of “the content and realities of these materials as the sexual abuse and exploitation of children.” Id.

2 ¶ 11 a. Finerty’s Testimony

¶ 12 Finerty testified she supervises the Child Exploitation Investigations Unit of HSI’s Chicago

branch (HSI-Chicago). In 2021, she began investigating Baby1517, a chat group in which

members exchange CSAM images and videos “featuring prepubescent minors, pubescent minors,

either nude or engaged in sexual acts with either other children or adults.” The chat group existed

on Mega, a cloud-based chat application with end-to-end encryption, and was created by someone

in South Africa. The group can only be joined by invitation; a group administrator “has to send

you a text verification to allow you to join.” The name “Baby1517” indicates the group contains

explicit material “concerning children between [the] ages of 15 and 17.” On February 20, 2021,

Finerty first noticed the Mega group included a “Jose” linked to a phone number with a 630 area

code (630 number). In July 2021, HSI’s South Africa branch (HSI-Pretoria), noticed “Jose” had

been changed to “Siempre Puma.” HSI-Pretoria sent HSI-Chicago a preliminary investigative

report with the 630 number, along with two associated addresses, one in Bolingbrook and the other

in Lansing. The 630 number “came back to Jose Cervantes.” HSI-Chicago conducted database

checks and found the 630 number linked to a Bolingbrook residence. Finerty ruled out the Lansing

address because it was a Boost Mobile store and all the research pointed to the Bolingbrook

address, which was in HSI-Pretoria’s initial lead.

¶ 13 On September 15, 2021, Finerty went to the Bolingbrook address along with Castaneda,

who speaks Spanish. Finerty and Castaneda were greeted by defendant’s wife. They waited in the

living room until defendant arrived at the residence. They spoke with defendant alone. Finerty

explained, with Castaneda interpreting, that they were working on a CSAM investigation and had

received information regarding a Telegram or Mega chat group. Defendant stated he had accounts

with both Telegram and Mega, he used Telegram to watch soccer tournaments, and he had seen

3 pornography and CSAM on both applications. Defendant further stated he was in Baby1517 and

had seen CSAM but had never uploaded it. Defendant stated his screen name was “Siempre Puma”

and he had previously used the name “Jose.” Defendant showed the agents how he obtained a text-

verification code to be able to log in to the Mega account and to join Baby1517. Defendant

provided the agents with verbal and written consent to examine his phone. Defendant apologized

for viewing the CSAM.

¶ 14 The agents took defendant’s phone and transported it to HSI’s Oak Brook office, where it

was turned over to McCabe, a computer forensic agent. Finerty did not personally see any evidence

of CSAM on defendant’s phone. Based on the computer forensic report and her discussions with

McCabe, Finerty learned that CSAM was found on defendant’s phone. When asked whether the

images on Mega were “controlled by defendant,” Finerty testified she only knows what defendant

had said, namely, that he viewed CSAM using Mega.

¶ 15 b. Castaneda’s Testimony

¶ 16 Castaneda testified he works in the Child Sex Crimes Unit of the Chicago Police

Department. He speaks Spanish fluently. In 2021, he worked alongside HSI-Chicago investigating

cybercrimes against children. He accompanied Finerty to defendant’s Bolingbrook residence to

“support and translate.” He was given “a very brief synopsis of the investigation.” Castaneda and

Finerty spoke with defendant’s wife initially. Defendant arrived 20 to 30 minutes later. Castaneda

did not ask any questions directly; he only interpreted Finerty’s questions and defendant’s answers.

Defendant said he viewed pornography on his phone, and that he had also viewed CSAM “through

his phone apps.” Defendant “was sorry for having viewed those images of minors, videos and

images that he found on those applications.” Asked whether defendant apologized for

“downloading any images,” Castaneda responded that defendant was “apologetic for viewing

4 them.” Castaneda did not analyze defendant’s phone. He only learned “from HSI Forensics” that

CSAM was found on defendant’s phone.

¶ 17 c. McCabe’s Testimony

¶ 18 McCabe is a computer forensic agent with HSI-Chicago. The court qualified him as an

expert in computer forensic analysis. He testified that an LG Stylo 5x mobile phone was tendered

to him for data extraction. He “tried extracting the information based on what the case agent

relayed to [him] about the investigation.” He used software called XRY to view all the phone’s

files, file folders, and subfolders on a computer display. The software “will give you everything

that’s on the phone,” including “sub-folders that you generally don’t see on your phone.” The

software also “show(s) cache and thumbnails.” McCabe explained that “thumbnails are created in

a sub-folder on Android that you can’t see.” When a video or image is downloaded on an Android

phone, the phone “make[s] a thumbnail as a quick reference for the user of the phone, so they can

go back to it.”

¶ 19 McCabe discovered 256 thumbnail images in the phone’s media file system that the

National Center for Missing and Exploited Children (NCMEC) confirmed were CSAM. He

explained that NCMEC “has millions of these CSAM images,” which NCMEC will “hash ***

into an alphanumerical code.” So “instead of actually viewing [the CSAM images] individually on

the computer, we’re looking at that code.”

¶ 20 Once the full logical file system was obtained, McCabe placed the evidence on a thumb

drive and turned it over to the case agent. McCabe found the three thumbnail images on which the

CSAM charges were predicated while analyzing the files extracted from defendant’s phone. He

did not see any creation or access dates for the thumbnails on the phone. He did not research how

the thumbnails were accessed. The three thumbnails were in a subfolder “auto-created by the

5 Android system.” McCabe agreed that thumbnails are placed in “some folder in your phone

automatically without you doing anything.” He testified that “[m]ost users don’t realize that folder

is there.”

¶ 21 d. Stipulations

¶ 22 The parties stipulated that, on September 15, 2021, Finerty delivered defendant’s phone,

an LG Stylo 5x, to HSI agent Steven Poniatowski, who then transported the phone to the HSI

forensic laboratory for analysis.

¶ 23 The parties also stipulated that the images taken from defendant’s phone, and listed in the

bill of indictment, constituted CSAM.

¶ 24 2. Motion for “Directed Verdict”

¶ 25 Defendant moved for a “directed verdict” at the close of the State’s case-in-chief. He

argued the State failed to establish possession, “which requires knowledge and requires intent.”

Citing McCabe’s testimony that most Android users do not realize a thumbnail folder exists,

defendant argued the State failed to prove defendant had “knowledge” of CSAM possession or

that he had “actual exclusive control.” The court denied the motion.

¶ 26 The next day, defendant moved to reconsider the court’s ruling, arguing People v. Bledsoe,

2023 IL App (5th) 220785-U, undercut McCabe’s expert testimony and warranted a directed

verdict. Defendant also moved, in the alternative, to dismiss two of the three CSAM counts and to

“reopen proofs and allow the Bledsoe case to be used as evidence to impeach the credibility of the

State’s expert witness.” The court denied the motion.

¶ 27 3. Defendant’s Case-in-Chief

¶ 28 The defense called defendant and his wife, Norma Uribe Ayala, to testify.

¶ 29 a. Ayala’s Testimony

6 ¶ 30 Ayala testified that Castaneda and “Officer Jennifer” arrived at her home while defendant

was at work. Castaneda identified himself as a Chicago policeman and addressed her directly, in

Spanish. Officer Jennifer did not address her. Castaneda told her they needed to speak with

defendant because they believed his phone had been hacked and his data had been compromised.

Ayala allowed them inside while they waited for defendant to arrive. Once defendant arrived,

Ayala left to pick up her daughters from school. On her return, she observed defendant handing

over his phone to the agents. In early October 2021, someone from the Department of Children

and Family Services informed defendant he needed to leave the house. Defendant was arrested

later that month at his workplace.

¶ 31 Defendant’s phone was on a service plan purchased at a Boost Mobile store in Bolingbrook.

After defendant’s arrest, Ayala went back to the Boost Mobile store for information regarding

defendant’s phone. Based on the information she received, Ayala believed defendant’s phone had

been hacked.

¶ 32 The court sustained objections to questions about the information Ayala received from

Boost Mobile. The court also denied defendant’s attempt to introduce a “court-approved legal

notice” of a class-action suit concerning a T-Mobile data breach. The court found defense counsel

had failed to prove discovery compliance as it related to the legal notice and, in any event, the

legal notice said “nothing about hacking or anything of that nature.”

¶ 33 b. Defendant’s Testimony

¶ 34 Defendant testified he did not have any CSAM on his phone on September 15, 2021, when

the agents came to his home. The agents checked all the pictures in his photo gallery, and “they

didn’t find anything.” He did not have “any of those things” because his phone was always

accessible to his family. He told agents he was using his Telegram app to watch sports when he

7 accidentally “bumped into this link, and it took me to that website.” When the CSAM images came

up on the screen, it was impossible to not look at them, and he “got out of there quickly.” Defendant

did not download any of those images, and he never saw them again.

¶ 35 4. The Trial Court’s Ruling

¶ 36 The court found defendant guilty on all three counts. It concluded defendant knowingly

accessed Baby1517, observing “[y]ou need to have a password for it” and “you need to be invited.”

It highlighted testimony that defendant admitted to viewing pornography, that defendant

apologized to the agents for his viewing, and that the forensic analysis uncovered the three CSAM

images in a folder with over 200 CSAM images. The court found “this was possession” based on

McCabe’s explanation that a thumbnail is created when visual media is downloaded. The court

further found that “unless someone was trained,” they “would not know that it was in that particular

folder when they looked at it.”

¶ 37 B. Posttrial Proceedings

¶ 38 On July 17, 2024, defendant moved once again to reconsider the denial of his motion for a

“directed verdict,” renewing his reliance on Bledsoe. He also moved, in the alternative, to reopen

proofs, to dismiss two of the three counts, or to set the matter for a new trial. The court denied the

motion in its entirety and set the matter for sentencing. Later that afternoon, defendant filed an

“interlocutory” notice of appeal.

¶ 39 On August 21, 2024, the court sentenced defendant to 48 months of probation and 300

hours of community service.

¶ 40 Defendant did not file a timely notice of appeal following the sentencing order (see Ill. S.

Ct. R. 606(b) (eff. Apr. 15, 2024)) and did not attempt to file a late notice of appeal (see Ill. S. Ct.

R. 606(c) (eff. Apr. 15, 2024)). In September 2025, we dismissed the appeal for lack of jurisdiction

8 and noted that only the supreme court has the authority to confer on this court jurisdiction when it

is otherwise lacking. People v. Cervantes-Diaz, No. 3-24-0463 (2025) (unpublished summary

order under Illinois Supreme Court Rule 23(c)). Thereafter, defendant petitioned the supreme court

for leave to appeal. The Illinois Supreme Court denied his petition and directed this court to vacate

the September 2025 dismissal order and to allow defendant to file a late notice of appeal.

Defendant filed his late notice of appeal on March 25, 2026.

¶ 41 II. ANALYSIS

¶ 42 Defendant’s opening brief does not provide a clear roadmap for review. (Defendant did not

file a reply brief.) Though prepared by counsel using the supreme court’s standardized form,

defendant’s brief raises a medley of grievances across three issue sections. It quotes law without

clear application to the record, its arguments do not consistently track the issues identified, and it

shifts between contentions without sufficiently developing any one of them. Our analysis proceeds,

nevertheless, from a generous reading of the brief.

¶ 43 Defendant argues the trial court erred in denying his posttrial “motion to reconsider

directed verdict.” Alternatively, defendant asks that we find error in the court’s denial of his

motions to dismiss two of the three CSAM counts and in its denial of his motion to admit evidence

in his case-in-chief. Defendant also argues reversal is warranted based on a purported speedy-trial

violation. We begin with the defendant’s attempt to challenge the court’s denial of his posttrial

“motion to reconsider directed verdict.”

¶ 44 A. Motion for “Directed Verdict”

¶ 45 A motion for directed verdict (in a jury trial) or directed finding (in a bench trial) asserts

the evidence is insufficient as a matter of law to support a guilty verdict or finding. People v.

Connolly, 322 Ill. App. 3d 905, 915 (2001). For purposes of such a motion, the defendant admits

9 the truth of the facts in the State’s case-in-chief, and the trial court considers the State’s evidence

in a light most favorable to the State. Id.

¶ 46 Defendant moved for a “directed verdict” at the close of the State’s case and sought

reconsideration the next day. After the court denied both motions, defendant elected to present his

evidence. This election constituted an affirmative waiver of the court’s ruling on defendant’s

motion. “In civil as in criminal cases, a defendant who elects to present evidence after his or her

motion for directed verdict has been denied is deemed to have waived any right to a directed

verdict.” Heastie v. Roberts, 226 Ill. 2d 515, 544 (2007) (citing People ex rel. Kubala v. Woods,

52 Ill. 2d 48, 54 (1972)). By putting on evidence, defendant abandoned the premise of his motion

for “directed verdict,” which admitted the truth of the factual record created by the State’s case-

in-chief. Moreover, defendant’s posttrial “motion to reconsider directed verdict” came too late.

Once he presented evidence, only a renewed motion at the close of all the evidence could preserve

the issue. See People v. Wilson, 143 Ill. 2d 236, 245 (1991). Defendant failed to renew his motion

at the close of all evidence, effectively depriving himself of the only basis to avoid waiver.

¶ 47 We emphasize that defendant has not merely forfeited the directed-finding issue; he waived

it. See Heastie, 226 Ill. 2d at 544; Wilson, 143 Ill. 2d at 245. While forfeiture is not a limitation on

this court, the supreme court has “never stated that the same is true of waiver.” People v. Ratliff,

2024 IL 129356, ¶ 26. Defendant’s waiver thus precludes our review of the issue.

¶ 48 B. One-Act, One-Crime Doctrine

¶ 49 Next, defendant invokes the one-act, one-crime doctrine to argue the charges against him

can only support a single conviction for CSAM possession. Before considering one-act, one-crime

principles, however, the court must “determine the unit of prosecution of the offense at issue.”

People v. Hartfield, 2022 IL 126729, ¶ 67. “The unit of prosecution of an offense refers to what

10 act or course of conduct the legislature has prohibited for purposes of a single conviction and

sentence.” Id. We review this issue de novo. People v. Daigle, 2024 IL App (4th) 230015, ¶ 83.

¶ 50 Defendant’s argument relies heavily on People v. McSwain, 2012 IL App (4th) 100619. In

McSwain, the court vacated four of the defendant’s five CSAM convictions predicated on the

simultaneous possession of five images in a single e-mail. Id. ¶ 46. The court found the 2008

version of the CSAM statute ambiguous, concluding the term “any” in the statute failed to

adequately define the allowable unit of prosecution. Id. ¶ 59. In view of the statute’s ambiguity,

the court applied the rule of lenity and held that the simultaneous possession of CSAM images

could not support multiple convictions. Id.

¶ 51 Defendant’s reliance on McSwain is ineffective. In 2014, McSwain was superseded by an

amendment to the CSAM statute expressly authorizing separate convictions for the possession of

different CSAM depictions. Pub. Act 98-437 (eff. Jan. 1, 2014) (adding 720 ILCS 5/11-20.1(a-5)).

The amendment expressly defined the offense’s unit of prosecution:

“The possession of each individual film, videotape, photograph, or other similar

visual reproduction or depiction by computer in violation of this Section constitutes

a single and separate violation. This subsection (a-5) does not apply to multiple

copies of the same film, videotape, photograph, or other similar visual reproduction

or depiction by computer that are identical to each other.” Id.

This addition clarified that the offense is measured by the number of distinct CSAM depictions in

the defendant’s possession. See Daigle, 2024 IL App (4th) 230015, ¶ 85. Thus, while McSwain

rested on the former statute’s ambiguity, subsection (a-5) eliminates that ambiguity by treating the

possession of each non-identical depiction as a separate offense.

11 ¶ 52 Defendant also argues the one-act, one-crime doctrine applies because “there is no

evidence that these were separate transactions.” He notes the three images were found in the same

thumbnail folder and lacked download or access timestamps. This argument fails at its premise.

The amended statute makes the possession of each distinct CSAM depiction a separate violation,

irrespective of the acquisition date or storage location. See 720 ILCS 5/11-20.1(a-5) (West 2022).

We reject defendant’s attempt to rewrite the offense’s unit of prosecution.

¶ 53 Here, the indictment made clear that each count was based on a different image, both by

describing the image and by identifying its MD5 hash. Because each count corresponds to a distinct

image, the convictions punish three separately chargeable possessory offenses. Id. The one-act,

one-crime doctrine provides no basis to merge those distinct images into one offense.

¶ 54 C. Speedy Trial

¶ 55 Next, defendant argues the delay of his trial violated his statutory and constitutional

speedy-trial rights. The State responds that this argument is forfeited under Illinois Supreme Court

Rule 341(h)(7) (eff. Oct. 2020). We agree with the State.

¶ 56 Defendant’s statutory theory is unclear. Defendant quotes portions of subsections (a) and

(b) of the speedy-trial statute and seems to suggest both subsections govern this case. See 725

ILCS 5/103-5(a), (b) (West 2022). Subsection (a) applies to a defendant “in custody” and generally

requires trial within 120 days, while subsection (b) applies to a defendant “on pretrial release or

recognizance” and generally requires trial within 160 days after a written demand. Id. Defendant

does not say how these two provisions interact on the case’s procedural timeline. He mentions two

potentially relevant pretrial dates but does not attempt to identify the operative speedy-trial period,

let alone calculate the time chargeable to the State or account for any delays occasioned by him.

12 ¶ 57 Defendant’s constitutional theory, moreover, is nonexistent. He makes no attempt to prove

the delay was presumptively prejudicial or to balance the relevant factors, including the length of

delay, the reason for delay, the defendant’s assertion of the right, and the prejudice to the defense.

See Barker v. Wingo, 407 U.S. 514, 530 (1972); People v. Kaczmarek, 207 Ill. 2d 288, 294-95

(2003). A reviewing court is entitled to a coherent legal argument. See Ill. S. Ct. R. 341(h)(7) (eff.

Oct. 1. 2020). Defendant’s failure to develop his speedy-trial argument constitutes a forfeiture of

his claim. Id. (“Points not argued are forfeited.”).

¶ 58 D. Evidentiary Exclusions

¶ 59 Finally, defendant argues the trial court wrongly excluded evidence supporting his theory

that his phone had been hacked following a T-Mobile data breach. This evidence included

defendant’s Boost Mobile account records and a legal notice concerning the T-Mobile data breach.

¶ 60 A trial court’s evidentiary ruling is reviewed for an abuse of discretion. People v. Becker,

239 Ill. 2d 215, 234 (2010). “An abuse of discretion occurs where the trial court’s decision is

arbitrary, fanciful or unreasonable [citation] or where no reasonable person would agree with the

position adopted by the trial court.” Id. Evidence is admissible only if it is relevant, and evidence

is properly excluded when it “has little probative value due to its remoteness, uncertainty, or

speculative nature.” People v. Enis, 139 Ill. 2d 264, 282 (1990). Here, the proposed evidence

showed that a company-wide data breach occurred and that defendant may have received notice

of it. It did not show that a bad actor infiltrated defendant’s phone and deposited CSAM thumbnails

in its media file system. We cannot say the trial court’s decision to exclude the legal notice was an

abuse of discretion.

¶ 61 III. CONCLUSION

¶ 62 We affirm the judgment of the circuit court of Will County.

13 ¶ 63 Affirmed.