NOTICE: This order was filed under Supreme Court Rule 23 and is not precedent except in the limited circumstances allowed under Rule 23(e)(1).
2026 IL App (3d) 240463-UB
Order filed June 9, 2026
____________________________________________________________________________
IN THE
APPELLATE COURT OF ILLINOIS THIRD DISTRICT
2026
THE PEOPLE OF THE STATE OF ) Appeal from the Circuit Court ILLINOIS, ) of the 12th Judicial Circuit, ) Will County, Illinois, Plaintiff-Appellee, )
) Appeal No. 3-24-0463 v. ) Circuit No. 21-CF-1527 )
JOSE RAMON CERVANTES-DIAZ, ) Honorable ) Carmen J. Goodman, Defendant-Appellant. ) Judge, Presiding.
____________________________________________________________________________
JUSTICE DAVENPORT delivered the judgment of the court.
Presiding Justice Hettel and Justice Bertani concurred in the judgment.
____________________________________________________________________________
ORDER
¶1 Held: The simultaneous possession of multiple instances of child sexual abuse material can sustain multiple convictions; defendant waived the trial court’s ruling on his motion for directed finding and forfeited his speedy-trial contention; the trial court did not abuse its discretion in excluding evidence. Affirmed.
¶2 After a bench trial, defendant, Jose Ramon Cervantes-Diaz, was found guilty of three counts of child pornography (hereinafter referred to as child sexual abuse material (CSAM) 1) (720
1
On January 1, 2026, the legislature changed all references in Illinois statutes from “child pornography” to “child sexual abuse material.” Pub. Act 104-245, § 50 (eff. Jan. 1, 2026) (amending 720
ILCS 5/11-20.1(a)(6) (West 2022)), predicated on three digital images found in defendant’s cell phone. We affirm.
¶3 I. BACKGROUND
¶4 In October 2021, defendant was taken into custody on charges of CSAM possession. The following month, a grand jury indicted defendant on three counts, each charging him with knowingly possessing, on a cell phone, a CSAM image depicting a child under the age of 13. The bill of indictment identified each image by a distinct 32-character alphanumeric “MD5 hash.”
¶5 In July 2023, defendant moved to dismiss, arguing he was the victim of hacking and the State presented no evidence the inculpatory images were stored on defendant’s personal device, “only that they were disseminated and electronically vaguely accessed by [an] electronic device they believe to be [defendant’s].” Defendant attached his Boost Mobile phone records and a 2021 news article titled, “T-Mobile reaches $500M settlement in data breach.” The State moved to strike defendant’s motion. Finding that defendant’s motion went to the merits of the case, the trial court granted the State’s motion.
¶6 On November 21, 2023, defendant moved for pretrial release and filed a speedy-trial demand. Defendant was granted pretrial release the same day, and the matter was set for trial.
¶7 A. Bench Trial
¶8 The court conducted a bench trial on April 30 and May 1, 2024.
¶9 1. State’s Case-in-Chief
¶ 10 The State called three witnesses, all affiliated with a CSAM investigation conducted by Homeland Security Investigations (HSI): Jennifer Finerty, Jose Castaneda, and Terrance McCabe.
ILCS 5/11-20.1(a)). The name change is not a change in the law, but a reflection of “the content and realities of these materials as the sexual abuse and exploitation of children.” Id.
3
¶ 11 a. Finerty’s Testimony
¶ 12 Finerty testified she supervises the Child Exploitation Investigations Unit of HSI’s Chicago branch (HSI-Chicago). In 2021, she began investigating Baby1517, a chat group in which members exchange CSAM images and videos “featuring prepubescent minors, pubescent minors, either nude or engaged in sexual acts with either other children or adults.” The chat group existed on Mega, a cloud-based chat application with end-to-end encryption, and was created by someone in South Africa. The group can only be joined by invitation; a group administrator “has to send you a text verification to allow you to join.” The name “Baby1517” indicates the group contains explicit material “concerning children between [the] ages of 15 and 17.” On February 20, 2021, Finerty first noticed the Mega group included a “Jose” linked to a phone number with a 630 area code (630 number). In July 2021, HSI’s South Africa branch (HSI-Pretoria), noticed “Jose” had been changed to “Siempre Puma.” HSI-Pretoria sent HSI-Chicago a preliminary investigative report with the 630 number, along with two associated addresses, one in Bolingbrook and the other in Lansing. The 630 number “came back to Jose Cervantes.” HSI-Chicago conducted database checks and found the 630 number linked to a Bolingbrook residence. Finerty ruled out the Lansing address because it was a Boost Mobile store and all the research pointed to the Bolingbrook address, which was in HSI-Pretoria’s initial lead.
¶ 13 On September 15, 2021, Finerty went to the Bolingbrook address along with Castaneda, who speaks Spanish. Finerty and Castaneda were greeted by defendant’s wife. They waited in the living room until defendant arrived at the residence. They spoke with defendant alone. Finerty explained, with Castaneda interpreting, that they were working on a CSAM investigation and had received information regarding a Telegram or Mega chat group. Defendant stated he had accounts with both Telegram and Mega, he used Telegram to watch soccer tournaments, and he had seen
4
pornography and CSAM on both applications. Defendant further stated he was in Baby1517 and had seen CSAM but had never uploaded it. Defendant stated his screen name was “Siempre Puma” and he had previously used the name “Jose.” Defendant showed the agents how he obtained a text- verification code to be able to log in to the Mega account and to join Baby1517. Defendant provided the agents with verbal and written consent to examine his phone. Defendant apologized for viewing the CSAM.
¶ 14 The agents took defendant’s phone and transported it to HSI’s Oak Brook office, where it was turned over to McCabe, a computer forensic agent. Finerty did not personally see any evidence of CSAM on defendant’s phone. Based on the computer forensic report and her discussions with McCabe, Finerty learned that CSAM was found on defendant’s phone. When asked whether the images on Mega were “controlled by defendant,” Finerty testified she only knows what defendant had said, namely, that he viewed CSAM using Mega.
¶ 15 b. Castaneda’s Testimony
¶ 16 Castaneda testified he works in the Child Sex Crimes Unit of the Chicago Police Department. He speaks Spanish fluently. In 2021, he worked alongside HSI-Chicago investigating cybercrimes against children. He accompanied Finerty to defendant’s Bolingbrook residence to “support and translate.” He was given “a very brief synopsis of the investigation.” Castaneda and Finerty spoke with defendant’s wife initially. Defendant arrived 20 to 30 minutes later. Castaneda did not ask any questions directly; he only interpreted Finerty’s questions and defendant’s answers. Defendant said he viewed pornography on his phone, and that he had also viewed CSAM “through his phone apps.” Defendant “was sorry for having viewed those images of minors, videos and images that he found on those applications.” Asked whether defendant apologized for “downloading any images,” Castaneda responded that defendant was “apologetic for viewing
5
them.” Castaneda did not analyze defendant’s phone. He only learned “from HSI Forensics” that CSAM was found on defendant’s phone.
¶ 17 c. McCabe’s Testimony
¶ 18 McCabe is a computer forensic agent with HSI-Chicago. The court qualified him as an expert in computer forensic analysis. He testified that an LG Stylo 5x mobile phone was tendered to him for data extraction. He “tried extracting the information based on what the case agent relayed to [him] about the investigation.” He used software called XRY to view all the phone’s files, file folders, and subfolders on a computer display. The software “will give you everything that’s on the phone,” including “sub-folders that you generally don’t see on your phone.” The software also “show(s) cache and thumbnails.” McCabe explained that “thumbnails are created in a sub-folder on Android that you can’t see.” When a video or image is downloaded on an Android phone, the phone “make[s] a thumbnail as a quick reference for the user of the phone, so they can go back to it.”
¶ 19 McCabe discovered 256 thumbnail images in the phone’s media file system that the National Center for Missing and Exploited Children (NCMEC) confirmed were CSAM. He explained that NCMEC “has millions of these CSAM images,” which NCMEC will “hash *** into an alphanumerical code.” So “instead of actually viewing [the CSAM images] individually on the computer, we’re looking at that code.”
¶ 20 Once the full logical file system was obtained, McCabe placed the evidence on a thumb drive and turned it over to the case agent. McCabe found the three thumbnail images on which the CSAM charges were predicated while analyzing the files extracted from defendant’s phone. He did not see any creation or access dates for the thumbnails on the phone. He did not research how the thumbnails were accessed. The three thumbnails were in a subfolder “auto-created by the
6
Android system.” McCabe agreed that thumbnails are placed in “some folder in your phone automatically without you doing anything.” He testified that “[m]ost users don’t realize that folder is there.”
¶ 21 d. Stipulations
¶ 22 The parties stipulated that, on September 15, 2021, Finerty delivered defendant’s phone, an LG Stylo 5x, to HSI agent Steven Poniatowski, who then transported the phone to the HSI forensic laboratory for analysis.
¶ 23 The parties also stipulated that the images taken from defendant’s phone, and listed in the bill of indictment, constituted CSAM.
¶ 24 2. Motion for “Directed Verdict”
¶ 25 Defendant moved for a “directed verdict” at the close of the State’s case-in-chief. He argued the State failed to establish possession, “which requires knowledge and requires intent.” Citing McCabe’s testimony that most Android users do not realize a thumbnail folder exists, defendant argued the State failed to prove defendant had “knowledge” of CSAM possession or that he had “actual exclusive control.” The court denied the motion.
¶ 26 The next day, defendant moved to reconsider the court’s ruling, arguing People v. Bledsoe, 2023 IL App (5th) 220785-U, undercut McCabe’s expert testimony and warranted a directed verdict. Defendant also moved, in the alternative, to dismiss two of the three CSAM counts and to “reopen proofs and allow the Bledsoe case to be used as evidence to impeach the credibility of the State’s expert witness.” The court denied the motion.
¶ 27 3. Defendant’s Case-in-Chief
¶ 28 The defense called defendant and his wife, Norma Uribe Ayala, to testify.
¶ 29 a. Ayala’s Testimony
7
¶ 30 Ayala testified that Castaneda and “Officer Jennifer” arrived at her home while defendant was at work. Castaneda identified himself as a Chicago policeman and addressed her directly, in Spanish. Officer Jennifer did not address her. Castaneda told her they needed to speak with defendant because they believed his phone had been hacked and his data had been compromised. Ayala allowed them inside while they waited for defendant to arrive. Once defendant arrived, Ayala left to pick up her daughters from school. On her return, she observed defendant handing over his phone to the agents. In early October 2021, someone from the Department of Children and Family Services informed defendant he needed to leave the house. Defendant was arrested later that month at his workplace.
¶ 31 Defendant’s phone was on a service plan purchased at a Boost Mobile store in Bolingbrook. After defendant’s arrest, Ayala went back to the Boost Mobile store for information regarding defendant’s phone. Based on the information she received, Ayala believed defendant’s phone had been hacked.
¶ 32 The court sustained objections to questions about the information Ayala received from Boost Mobile. The court also denied defendant’s attempt to introduce a “court-approved legal notice” of a class-action suit concerning a T-Mobile data breach. The court found defense counsel had failed to prove discovery compliance as it related to the legal notice and, in any event, the legal notice said “nothing about hacking or anything of that nature.”
¶ 33 b. Defendant’s Testimony
¶ 34 Defendant testified he did not have any CSAM on his phone on September 15, 2021, when the agents came to his home. The agents checked all the pictures in his photo gallery, and “they didn’t find anything.” He did not have “any of those things” because his phone was always accessible to his family. He told agents he was using his Telegram app to watch sports when he
8
accidentally “bumped into this link, and it took me to that website.” When the CSAM images came up on the screen, it was impossible to not look at them, and he “got out of there quickly.” Defendant did not download any of those images, and he never saw them again.
¶ 35 4. The Trial Court’s Ruling
¶ 36 The court found defendant guilty on all three counts. It concluded defendant knowingly accessed Baby1517, observing “[y]ou need to have a password for it” and “you need to be invited.” It highlighted testimony that defendant admitted to viewing pornography, that defendant apologized to the agents for his viewing, and that the forensic analysis uncovered the three CSAM images in a folder with over 200 CSAM images. The court found “this was possession” based on McCabe’s explanation that a thumbnail is created when visual media is downloaded. The court further found that “unless someone was trained,” they “would not know that it was in that particular folder when they looked at it.”
¶ 37 B. Posttrial Proceedings
¶ 38 On July 17, 2024, defendant moved once again to reconsider the denial of his motion for a “directed verdict,” renewing his reliance on Bledsoe. He also moved, in the alternative, to reopen proofs, to dismiss two of the three counts, or to set the matter for a new trial. The court denied the motion in its entirety and set the matter for sentencing. Later that afternoon, defendant filed an “interlocutory” notice of appeal.
¶ 39 On August 21, 2024, the court sentenced defendant to 48 months of probation and 300 hours of community service.
¶ 40 Defendant did not file a timely notice of appeal following the sentencing order (see Ill. S. Ct. R. 606(b) (eff. Apr. 15, 2024)) and did not attempt to file a late notice of appeal (see Ill. S. Ct. R. 606(c) (eff. Apr. 15, 2024)). In September 2025, we dismissed the appeal for lack of jurisdiction
9
and noted that only the supreme court has the authority to confer on this court jurisdiction when it is otherwise lacking. People v. Cervantes-Diaz, No. 3-24-0463 (2025) (unpublished summary order under Illinois Supreme Court Rule 23(c)). Thereafter, defendant petitioned the supreme court for leave to appeal. The Illinois Supreme Court denied his petition and directed this court to vacate the September 2025 dismissal order and to allow defendant to file a late notice of appeal. Defendant filed his late notice of appeal on March 25, 2026.
¶ 41 II. ANALYSIS
¶ 42 Defendant’s opening brief does not provide a clear roadmap for review. (Defendant did not file a reply brief.) Though prepared by counsel using the supreme court’s standardized form, defendant’s brief raises a medley of grievances across three issue sections. It quotes law without clear application to the record, its arguments do not consistently track the issues identified, and it shifts between contentions without sufficiently developing any one of them. Our analysis proceeds, nevertheless, from a generous reading of the brief.
¶ 43 Defendant argues the trial court erred in denying his posttrial “motion to reconsider directed verdict.” Alternatively, defendant asks that we find error in the court’s denial of his motions to dismiss two of the three CSAM counts and in its denial of his motion to admit evidence in his case-in-chief. Defendant also argues reversal is warranted based on a purported speedy-trial violation. We begin with the defendant’s attempt to challenge the court’s denial of his posttrial “motion to reconsider directed verdict.”
¶ 44 A. Motion for “Directed Verdict”
¶ 45 A motion for directed verdict (in a jury trial) or directed finding (in a bench trial) asserts the evidence is insufficient as a matter of law to support a guilty verdict or finding. People v. Connolly, 322 Ill. App. 3d 905, 915 (2001). For purposes of such a motion, the defendant admits
10
the truth of the facts in the State’s case-in-chief, and the trial court considers the State’s evidence in a light most favorable to the State. Id.
¶ 46 Defendant moved for a “directed verdict” at the close of the State’s case and sought reconsideration the next day. After the court denied both motions, defendant elected to present his evidence. This election constituted an affirmative waiver of the court’s ruling on defendant’s motion. “In civil as in criminal cases, a defendant who elects to present evidence after his or her motion for directed verdict has been denied is deemed to have waived any right to a directed verdict.” Heastie v. Roberts, 226 Ill. 2d 515, 544 (2007) (citing People ex rel. Kubala v. Woods, 52 Ill. 2d 48, 54 (1972)). By putting on evidence, defendant abandoned the premise of his motion for “directed verdict,” which admitted the truth of the factual record created by the State’s case- in-chief. Moreover, defendant’s posttrial “motion to reconsider directed verdict” came too late. Once he presented evidence, only a renewed motion at the close of all the evidence could preserve the issue. See People v. Wilson, 143 Ill. 2d 236, 245 (1991). Defendant failed to renew his motion at the close of all evidence, effectively depriving himself of the only basis to avoid waiver.
¶ 47 We emphasize that defendant has not merely forfeited the directed-finding issue; he waived it. See Heastie, 226 Ill. 2d at 544; Wilson, 143 Ill. 2d at 245. While forfeiture is not a limitation on this court, the supreme court has “never stated that the same is true of waiver.” People v. Ratliff, 2024 IL 129356, ¶ 26. Defendant’s waiver thus precludes our review of the issue.
¶ 48 B. One-Act, One-Crime Doctrine
¶ 49 Next, defendant invokes the one-act, one-crime doctrine to argue the charges against him can only support a single conviction for CSAM possession. Before considering one-act, one-crime principles, however, the court must “determine the unit of prosecution of the offense at issue.” People v. Hartfield, 2022 IL 126729, ¶ 67. “The unit of prosecution of an offense refers to what
11
act or course of conduct the legislature has prohibited for purposes of a single conviction and sentence.” Id. We review this issue de novo. People v. Daigle, 2024 IL App (4th) 230015, ¶ 83.
¶ 50 Defendant’s argument relies heavily on People v. McSwain, 2012 IL App (4th) 100619. In McSwain, the court vacated four of the defendant’s five CSAM convictions predicated on the simultaneous possession of five images in a single e-mail. Id. ¶ 46. The court found the 2008 version of the CSAM statute ambiguous, concluding the term “any” in the statute failed to adequately define the allowable unit of prosecution. Id. ¶ 59. In view of the statute’s ambiguity, the court applied the rule of lenity and held that the simultaneous possession of CSAM images could not support multiple convictions. Id.
¶ 51 Defendant’s reliance on McSwain is ineffective. In 2014, McSwain was superseded by an amendment to the CSAM statute expressly authorizing separate convictions for the possession of different CSAM depictions. Pub. Act 98-437 (eff. Jan. 1, 2014) (adding 720 ILCS 5/11-20.1(a-5)). The amendment expressly defined the offense’s unit of prosecution:
“The possession of each individual film, videotape, photograph, or other similar visual reproduction or depiction by computer in violation of this Section constitutes a single and separate violation. This subsection (a-5) does not apply to multiple copies of the same film, videotape, photograph, or other similar visual reproduction or depiction by computer that are identical to each other.” Id.
This addition clarified that the offense is measured by the number of distinct CSAM depictions in the defendant’s possession. See Daigle, 2024 IL App (4th) 230015, ¶ 85. Thus, while McSwain rested on the former statute’s ambiguity, subsection (a-5) eliminates that ambiguity by treating the possession of each non-identical depiction as a separate offense.
12
¶ 52 Defendant also argues the one-act, one-crime doctrine applies because “there is no evidence that these were separate transactions.” He notes the three images were found in the same thumbnail folder and lacked download or access timestamps. This argument fails at its premise. The amended statute makes the possession of each distinct CSAM depiction a separate violation, irrespective of the acquisition date or storage location. See 720 ILCS 5/11-20.1(a-5) (West 2022). We reject defendant’s attempt to rewrite the offense’s unit of prosecution.
¶ 53 Here, the indictment made clear that each count was based on a different image, both by describing the image and by identifying its MD5 hash. Because each count corresponds to a distinct image, the convictions punish three separately chargeable possessory offenses. Id. The one-act, one-crime doctrine provides no basis to merge those distinct images into one offense.
¶ 54 C. Speedy Trial
¶ 55 Next, defendant argues the delay of his trial violated his statutory and constitutional speedy-trial rights. The State responds that this argument is forfeited under Illinois Supreme Court Rule 341(h)(7) (eff. Oct. 2020). We agree with the State.
¶ 56 Defendant’s statutory theory is unclear. Defendant quotes portions of subsections (a) and (b) of the speedy-trial statute and seems to suggest both subsections govern this case. See 725 ILCS 5/103-5(a), (b) (West 2022). Subsection (a) applies to a defendant “in custody” and generally requires trial within 120 days, while subsection (b) applies to a defendant “on pretrial release or recognizance” and generally requires trial within 160 days after a written demand. Id. Defendant does not say how these two provisions interact on the case’s procedural timeline. He mentions two potentially relevant pretrial dates but does not attempt to identify the operative speedy-trial period, let alone calculate the time chargeable to the State or account for any delays occasioned by him.
13
¶ 57 Defendant’s constitutional theory, moreover, is nonexistent. He makes no attempt to prove the delay was presumptively prejudicial or to balance the relevant factors, including the length of delay, the reason for delay, the defendant’s assertion of the right, and the prejudice to the defense. See Barker v. Wingo, 407 U.S. 514, 530 (1972); People v. Kaczmarek, 207 Ill. 2d 288, 294-95 (2003). A reviewing court is entitled to a coherent legal argument. See Ill. S. Ct. R. 341(h)(7) (eff. Oct. 1. 2020). Defendant’s failure to develop his speedy-trial argument constitutes a forfeiture of his claim. Id. (“Points not argued are forfeited.”).
¶ 58 D. Evidentiary Exclusions
¶ 59 Finally, defendant argues the trial court wrongly excluded evidence supporting his theory that his phone had been hacked following a T-Mobile data breach. This evidence included defendant’s Boost Mobile account records and a legal notice concerning the T-Mobile data breach.
¶ 60 A trial court’s evidentiary ruling is reviewed for an abuse of discretion. People v. Becker, 239 Ill. 2d 215, 234 (2010). “An abuse of discretion occurs where the trial court’s decision is arbitrary, fanciful or unreasonable [citation] or where no reasonable person would agree with the position adopted by the trial court.” Id. Evidence is admissible only if it is relevant, and evidence is properly excluded when it “has little probative value due to its remoteness, uncertainty, or speculative nature.” People v. Enis, 139 Ill. 2d 264, 282 (1990). Here, the proposed evidence showed that a company-wide data breach occurred and that defendant may have received notice of it. It did not show that a bad actor infiltrated defendant’s phone and deposited CSAM thumbnails in its media file system. We cannot say the trial court’s decision to exclude the legal notice was an abuse of discretion.
¶ 61 III. CONCLUSION
¶ 62 We affirm the judgment of the circuit court of Will County.
14
¶ 63 Affirmed.