People v. Schneider

2024 IL App (4th) 230524-U

• Court: Appellate Court of Illinois
• Decided: July 10, 2024
• Docket: 4-23-0524
• Status: Unpublished

Opinion

NOTICE 2024 IL App (4th) 230524-U This Order was filed under FILED NO. 4-23-0524 July 10, 2024 Supreme Court Rule 23 and is Carla Bender not precedent except in the IN THE APPELLATE COURT 4th District Appellate limited circumstances allowed Court, IL under Rule 23(e)(1). OF ILLINOIS

FOURTH DISTRICT

THE PEOPLE OF THE STATE OF ILLINOIS, ) Appeal from the Plaintiff-Appellee, ) Circuit Court of v. ) McLean County MICHAEL D. SCHNEIDER, ) No. 21CF711 Defendant-Appellant. ) ) Honorable ) William A. Yoder, ) Judge Presiding.

JUSTICE DOHERTY delivered the judgment of the court. Justice Harris concurred in the judgment. Justice Steigmann specially concurred in part and dissented in part.

ORDER

¶1 Held: The appellate court affirmed defendant’s sentence on 1 count, modified his consecutive sentences on 11 counts by applying a statutory cap of 28 years, and remanded the matter back to the trial court for resentencing on 3 counts.

¶2 In December 2022, defendant Michael Schneider entered a partially negotiated plea

of guilty to 15 Class 2 felony counts of possession of child pornography (720 ILCS 5/11-20.1(a)(6)

(West 2020)). In February 2023, the trial court conducted a sentencing hearing at which defendant

contended the maximum aggregate sentence was capped because all 15 counts to which he pleaded

guilty stemmed from a single course of conduct. The court disagreed and sentenced him to

consecutive sentences of 4 years in prison on each count, resulting in an aggregate sentence of 60

years in prison.

¶3 Defendant appeals, arguing that his 60-year aggregate sentence violated section 5- 8-4(f) of the Unified Code of Corrections (Code) (730 ILCS 5/5-8-4(f)(2) (West 2020)) because

his convictions for possession of child pornography all stemmed from one course of conduct and

are, therefore, subject to a statutory cap on his aggregate sentence. We hold that: (1) the trial court’s

finding that the offense in count 13 arose from a separate course of conduct from that giving rise

to the other charges is not against the manifest weight of the evidence; (2) the consecutive

sentences imposed on counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102 must be modified to

reflect that they are subject to a cumulative cap of 28 years’ imprisonment; and (3) the record does

not support the conclusion that counts 6, 8, and 17 stemmed from separate courses of conduct, so

we vacate the imposition of those sentences consecutively and remand the matter for resentencing.

¶4 I. BACKGROUND

¶5 A. The Charges

¶6 In July 2021, defendant was charged with a variety of offenses in two separate

cases. In McLean County case No. 21-CF-711, defendant was charged with 130 counts of

possession of child pornography, all Class 2 felonies (720 ILCS 5/11-20.1(a)(6) (West 2020)),

based on 130 photos and videos found in his possession on April 1, 2021. In McLean County case

No. 21-CF-712, defendant was charged with various sex crimes, including criminal sexual assault,

a Class 1 felony (id. § 11-1.20(a)(4)), and production of child pornography, a Class 1 felony (id.

§ 11-20.1(a)(1)(vii)), all of which involved L.M., defendant’s underage piano student. Both cases

were considered simultaneously by the trial court, but only case No. 21-CF-711 is at issue in this

appeal.

¶7 B. The Guilty Plea

¶8 In December 2022, defendant entered a guilty plea to (1) 15 counts of possession

of child pornography—namely, counts 6, 8, 13, 17, 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102

-2- in case No. 21-CF-711—which did not include photos of L.M., (2) 1 count of production of child

pornography for taking a sexually explicit photograph of L.M., and (3) 2 counts of criminal sexual

assault of L.M. In exchange, the State agreed to dismiss all other counts against him in both cases

and to recommend a 20-year prison sentence in case No. 21-CF-712. Defendant’s guilty plea to

the 15 counts in case No. 21-CF-711 was an open plea.

¶9 At the guilty plea hearing, the trial court admonished defendant regarding the plea

agreement, charges, and ranges of punishment in case No. 21-CF-712. The court then admonished

defendant regarding case No. 21-CF-711, explaining that each offense was a Class 2 felony,

punishable by a minimum of three, or a maximum of seven, years in prison, to be served

consecutively. Further, the court stated that the offenses were all separate and distinct acts. The

court did not admonish defendant that he was eligible for extended-term sentencing, and the State

did not indicate that it was pursuing extended-term sentencing.

¶ 10 As the factual basis for defendant’s guilty plea in case No. 21-CF-712, the State

proffered that on multiple occasions, starting in 2017, defendant sexually assaulted L.M., who was

between 13 and 15 years old at the time, and also took sexually explicit photos of her.

¶ 11 As the factual basis for defendant’s guilty plea in case No. 21-CF-711, the State

proffered the following:

“Next, Your Honor, in regards to [case No.] 21 CF 711, if that case were to

proceed to trial, the State would provide sufficient evidence to show that the

Normal Police Department, after being notified by L.M. that her music teacher the

defendant *** had sexually abused her over a course of years and had disclosed

that they had exchanged illicit photographs, a search warrant was [obtained for]

that residence. On April 1st of 2021[,] in [the execution of] that search warrant[,]

-3- 22 items were seized including multiple electronic devices. One of those devices

was a flash drive belonging to the defendant. In that flash drive in a folder[,] which

was labeled holiday spectacular 2015, contained another folder that was labeled

show files. In the show files folder multiple images and videos of suspected child

pornography were identified.”

¶ 12 The State then described the content of each image and video relevant to

defendant’s guilty plea and stated that an expert had opined that the images and videos depicted

minor children.

¶ 13 The trial court accepted the factual bases and defendant’s guilty plea.

¶ 14 C. The Sentencing Hearing

¶ 15 In February 2023, the trial court conducted a sentencing hearing in case Nos. 21-

CF-711 and 21-CF-712, at which the court received, among other things, (1) a presentence

investigation report, (2) a sex offender evaluation, (3) the testimony of Detective Jason Wood,

(4) victim impact statements, and (5) the State’s exhibits.

¶ 16 People’s Exhibit 1 contained the 15 media files underlying the 15 counts of

possession of child pornography in case No. 21-CF-711. The files were located inside a folder that,

when opened, showed a list of the 15 files, which included the file names and fields labeled “Date

modified” and “Date created” for each file. People’s Exhibit 2 contained the photographs of L.M.

and correspondence between defendant and L.M. from May 2017 through September 2017.

Defendant stipulated to both of these exhibits being admitted into evidence.

¶ 17 1. The Sex Offender Evaluation

¶ 18 The sex offender evaluation contained the evaluator’s report of an interview with

defendant, during which he was asked about the flash drive containing the child pornography. The

-4- report stated as follows:

“[Defendant] said that [L.M.] started sending him pictures of her trying on different

outfits. He admitted that he bought her alcohol and she then started to offer him

naked pictures of herself if he would continue to purchase the alcohol. He indicated

that he continued to buy alcohol for her, and she would send him the pictures. He

said that this was when he got interested in child pornography. He admitted that he

sought out and downloaded the material and saved it in a [flash] drive. He indicated

that he would masturbate to his material.”

¶ 19 2. Detective Jason Wood

¶ 20 Detective Jason Wood of the Normal Police Department testified that he

forensically examined a flash drive seized from defendant’s home on April 1, 2021. Wood utilized

a device which allowed him to read the contents of a flash drive without writing any new

information. This process created a “bit for bit” duplicate image of defendant’s flash drive.

¶ 21 Wood examined the metadata for a file titled “ESP732.MP4”, which was the image

that formed the basis of count 13 of case No. 21-CF-711. Wood testified that both the “created”

and “modified” dates for this image were February 24, 2017. Regarding what “created” and

“modified” meant, Wood gave a hypothetical example, stating, “So, the created date that was on

the computer was the day I put it on the computer. The date it was modified was the day that I

changed any data within that [file].” He explained that, unless some other source could show when

the item was stored on the flash drive, that the “created and modified” date of February 24, 2017,

showed that the item was “created and modified on [the flash drive] on or before that date.” Wood

did not discuss the evidence underlying the other 14 counts in case No. 21-CF-711.

¶ 22 Because the record does not provide a definition for “metadata,” we find the

-5- following definition in 126 Am. Jur. 3d Proof of Facts 281 §§ 1, 4 (April 2024 Update) helpful.

“Metadata is data typically stored electronically that describes

characteristics of electronically stored information (ESI) and is found in different

places in different forms. Metadata can be supplied by software applications, users,

or a computer's file system. Metadata can describe how, when, and by whom ESI

was collected, created, accessed, modified, and how it is formatted.

***

File system metadata consists of logs and other logistical information

generated by an operating system to track the demographics (name, size, location,

usage, etc.) of the ESI and not embedded within but stored externally from the

ESI. Examples of file system metadata that is frequently requested in litigation

include the DateModified, DateAccessed, and DateCreated fields, known as MAC

dates or fields.”

¶ 23 3. The Parties’ Arguments

¶ 24 The State recommended the maximum sentence of 7 years on each count in case

No. 21-CF-711 and recommended 20 years in prison for the three counts in case No. 21-CF-712.

The State highlighted defendant’s statements in the sex offender evaluation that he became

addicted to child pornography after L.M. sent him topless photos of herself, which led to his later

seeking out the pornographic images of other minors that the police found on his flash drive. The

State asserted that defendant’s claim that he had acquired all of the files at the same time was not

credible because Wood’s testimony established that the files were last created or modified in

February 2017, while the photos of L.M. were from May 2017 through September 2017.

¶ 25 Defense counsel responded that L.M. had been defendant’s student for years prior

-6- to 2017, which meant other photos could exist that were not in the record that would corroborate

defendant’s statements. He further pointed out that (1) all of the images were found on one flash

drive and that defendant was convicted of possessing them on April 1, 2021, and (2) Wood’s

testimony provided only the February 2017 date for a single file’s creation or last modification.

Citing section 5-8-4(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2020)), defense counsel

argued that because there was no evidence that the flash drive contained material acquired at

different times, the possession of the child pornography constituted a single course of conduct with

no substantial change in the criminal objective. Defense counsel asserted that because there was

only a single course of conduct, section 5-8-4(f)(2) capped the maximum allowable sentence.

¶ 26 The State replied that the Code allows each image to be charged as a single and

separate violation and requires consecutive sentences. The State further argued that defendant had

downloaded hundreds of images “over a period of time” and his “intent of possession was over

many months, if not years.”

¶ 27 4. Defendant’s Statement in Allocution

¶ 28 In allocation, defendant stated that he never sought out child pornography until

L.M. sent him photographs through Snapchat (a smartphone application for sending messages,

photos, and videos). He stated that L.M. sent him additional photos over time but eventually

stopped. He then struggled with his child pornography addiction, leading him to seek videos of

underage girls, which “resulted in acquiring the pictures that [he was] charged with possessing.”

Defendant alleged he downloaded the photos as one password protected “zip” file. He looked at

those photos once and never again.

¶ 29 5. The Sentence

¶ 30 After considering the evidence in mitigation and aggravation, the trial court noted

-7- that defendant was “being sentenced on 18 very serious felony offenses; three Class 1 felony

offenses in 21-CF-712; and 15 Class 2 felony offenses in 21-CF-711.” The court then sentenced

defendant on those offenses as follows:

“The defendant *** possessed photographs of [L.M.] in sexual poses and

possessed numerous images of child pornography. He has pled guilty to one count

of photographing the victim in [case No. 21-CF-712] and/or possessing a

photograph of the victim and 15 counts of possession of child pornography [in case

No. 21-CF-711].

I find that the defendant’s statement in relation to a single download is not

credible. As it relates to testimony of Det. Wood, images at different—I think it

was metadata creation dates. And I believe that these images of child pornography

are not part of a single course of conduct without a change in the criminal conduct

of the—criminal nature of the conduct.

As it relates to the 15 counts in 21-CF-711, these are Counts 6, 8, 13, 17,

18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102, the Court, as I previously mentioned,

believes that these were all separate and distinct acts and part of a separate course

of conduct. And the Court believes that an appropriate sentence on each of those

counts is four years to be followed up by a period of mandatory supervised release

at three years to life.”

¶ 31 Accordingly, the trial court sentenced defendant to 15 consecutive four-year

sentences—an aggregate sentence of 60 years’ imprisonment—on the 15 counts of possession of

-8- child pornography in case No. 21-CF-711.

¶ 32 D. The Motion to Reconsider

¶ 33 Defendant filed a motion to reconsider the sentence, realleging that the maximum

allowable sentence was 28 years because the 15 counts of possession of child pornography

constituted a single course of conduct. At a hearing on defendant’s motion, defendant argued that

(1) the State had charged only one date for the date of possession in all 15 counts, (2) the images

were all stored in a single location—namely, the flash drive, and (3) the images all appeared to

originate from the same source based on a watermark the images bore. Because nothing indicated

that the creation date of the images was different for any of the images and all the counts alleged

possession on April 1, 2021, defendant asserted that the offenses were part of a single course of

conduct with no change in the criminal objective.

¶ 34 Defendant asserted that his case was similar to People v. Thompson, 2022 IL App

(2d) 190950-U, in which the appellate court concluded that a 72-year aggregate sentence for

disseminating child pornography, a Class 1 felony (720 ILCS 5/11-20.1(a)(2) (West 2016)),

violated section 5-8-4(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2016)) because the acts of

sending multiple e-mails containing child pornography within a short time period constituted a

single course of conduct punishable by a maximum aggregate sentence of 60 years in prison.

¶ 35 The State responded that (1) the legislative history did not support defense

counsel’s argument and (2) the only evidence that the images were “downloaded with one single

click of a button was *** [d]efendant’s statement in allocution.” However, the State pointed out

that the sex offender evaluation was evidence the trial court could consider, and it showed that

defendant looked at child pornography on multiple occasions and was not truthful when he said

that he became addicted to child pornography only after L.M. sent him photos of herself. Wood’s

-9- testimony showed that the media file on the flash drive was acquired at a time earlier than when

he received those photos from L.M. The State continued, “When looking at the images and the

videos of the metadata it is clear that these were downloaded on multiple different dates over

months and months and months of time, and so to suggest to the Court [otherwise] is

inappropriate.”

¶ 36 The trial court concluded that defendant’s possession of the images in the flash

drive was not a single course of conduct, explaining as follows:

“So the question is in the court’s mind was the course of conduct—would

the acts conducted or taken in a—a series of acts taken with the same mental or

accompanying mental state?

So, the Defendant has indicated his mental state at the time that he

downloaded many of the—he was alleged to have downloaded many of the child

pornographic images, that being the mental state of an addiction caused by the

victim sending him partially clothed or nude images.

But the image—there was testimony at the sentencing hearing that one of

the images at least pre-dated any images from the victim being sent to the

Defendant. And so it would naturally flow from that that there was a different

mental state that caused the downloading of that image and therefore by definition

not part of the same course of conduct. And as a result of that, regardless of whether

the legislature intended for these to all be mandatorily consecutive and with no

aggregate limitation—regardless of that under the argument presented pursuant to

statute that allows for an aggregate maximum of the two most—the maximum of

the two most serious charges that only applies where the offenses were committed

- 10 - as part of a single course of conduct, and there is evidence in this case that that is

not the case, that there was not—these acts were not committed as part of a single

course of conduct during which there was no substantial change in the nature of the

criminal objective.

Therefore, the Court believes that it made the appropriate ruling at the time

of sentencing imposing mandatorily consecutive sentences on all of the counts in

[case No. 21-CF-711], and the motion to reduce the sentence or modify the sentence

is going to be denied.”

¶ 37 This appeal followed.

¶ 38 II. ANALYSIS

¶ 39 On appeal, defendant argues that his 60-year aggregate sentence violated section 5-

8-54(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2020)) because his convictions for

possession of child pornography all stemmed from a single course of conduct, thereby triggering

application of the statutory cap on the aggregate sentence.

¶ 40 A. Applicable Law—Cap on Mandatory Consecutive Sentences

¶ 41 The issues in this case all involve the proper application of different subsections of

section 5-8-4 of the Code, the first of which requires the imposition of consecutive sentences for

specified offenses. 730 ILCS 5/5-8-4(d) (West 2020). Here, defendant concedes that the Code

requires the imposition of consecutive sentences for all 15 offenses to which he pleaded guilty in

the instant case.

¶ 42 The second relevant subsection, section 5-8-4(f), is the one which provides for a

“cap” on the aggregate length of the consecutive sentences under certain circumstances:

“For sentences imposed under the law in effect on or after February 1, 1978, the

- 11 - aggregate of consecutive sentences for offenses that were committed as part of a

single course of conduct during which there was no substantial change in the nature

of the criminal objective shall not exceed the sum of the maximum terms authorized

under Article 4.5 of Chapter V for the 2 most serious felonies involved, but no such

limitation shall apply for offenses that were not committed as part of a single course

of conduct during which there was no substantial change in the nature of the

criminal objective.” Id. § 5-8-4(f)(2).

“ ‘The test to be used in determining whether a particular offense is part of a single course of

conduct, during which there was no *** [substantial] change in the nature of the criminal objective,

is the independent motivation test; that is, were the defendant’s acts independently motivated?’ ”

People v. Wilder, 325 Ill. App. 3d 987, 1001 (2001). “If there was a substantial change in the nature

of the criminal objective, the defendant’s offenses are part of an ‘unrelated course of conduct.’ ”

Id.

¶ 43 Here, there seems to be no suggestion that there was a substantial change in

defendant’s criminal objective across all 15 counts, i.e., to obtain and possess child pornography.

The question is whether, as the trial court found, each one of the 15 counts relates to a course of

conduct separate from the others, or whether some or all counts might relate to “a single course of

conduct.” 730 ILCS 5/5-8-4(f)(2) (West 2020).

¶ 44 B. The Trial Court’s Finding of No “Single Course of Conduct”

¶ 45 We begin our analysis by noting that the 15 illicit computer files at issue were all

found on a single device in defendant’s possession on a single date: April 1, 2021. In order to

construe defendant’s possession as separate acts (i.e., not a “single course of conduct”), it becomes

necessary to find in the record some basis to conclude that he possessed the files, or at least some

- 12 - of them, at an earlier date.

¶ 46 The trial court found that defendant’s acquisition of the 15 files at issue was “not

part of a single course of conduct without a change in the *** criminal nature of the conduct.” The

court did not explicitly share its reasoning for this conclusion. The only possible basis in the record

for such a finding would be the testimony of detective Wood or the file metadata reflected in

People’s Exhibit 1. We find that the issues presented are not identical with respect to each of the

computer files at issue, so we examine the basis for the trial court’s findings as to three separate

groups: (1) the single video file supporting count 13; (2) the 11 image files; and (3) the 3 remaining

video files. We undertake our review with the understanding that whether a defendant’s actions

constitute a single course of conduct or are part of an unrelated course of conduct is a question of

fact for the trial court, and a reviewing court will defer to the trial court’s determination unless it

is against the manifest weight of the evidence. People v. Robinson, 2015 IL App (1st) 130837,

¶ 102. “A finding is against the manifest weight of the evidence only if the opposite conclusion is

clearly evident or if the finding itself is unreasonable, arbitrary, or not based on the evidence

presented.” People v. Deleon, 227 Ill. 2d 322, 332 (2008).

¶ 47 1. The Video File—Count 13

¶ 48 At the sentencing hearing, the State called Detective Wood to provide his technical

interpretation of the metadata retrieved from the files on defendant’s flash drive. However, Wood

offered an opinion as to only one of the 15 files at issue, the video file relating to count 13 of the

indictment. The State asked Wood about both the “Date created” and “Date modified” information

for this file, and his answer suggested that the date reflected for each was the same: February 24,

2017. He then opined that this information meant that the file “was created and modified” on

defendant’s flash drive “on or before” February 24, 2017.

- 13 - ¶ 49 There were other questions not asked of Wood, such whether the “Date modified”

corresponding to each file could have been “inherited” (i.e., whether the date was imprinted on the

file before defendant obtained it). He was not asked what effect downloading the files via a “zip”

file would have had on the dates contained in the metadata. Finally, he was also not asked the

significance of the “Media created” date listed in the metadata for only one file, the video file

relating to count 8. Regardless, it is clear enough that Wood’s testimony was sufficient to support

the trial court’s implicit conclusion that defendant first obtained the video file relating to count 13

“on or before” February 24, 2017, i.e., prior to the April 1, 2021, date on which all 15 files were

seized. At least as to the file relating to count 13, this is sufficient to support the court’s conclusion

that defendant’s possession of that file is not part of a “single course of conduct” that includes the

other 14 files at issue.

¶ 50 2. The 11 Image Files

¶ 51 As noted above, the 11 image files were seized from defendant on April 1, 2021.

Absent evidence that individual files within that group of 11 were acquired on a different date or

dates, one would have to conclude that the offenses arising from possession of these files were part

of a “single course of conduct” that occurred on April 1, 2021.

¶ 52 Stated more succinctly, the dates stored in the computer file metadata of a

photograph or video on a flash drive may reflect the actions of the possessor of the flash drive,

while other dates may reflect actions taken by different people that affected the file; a key question

will often be whether a date contained in metadata reflects the former or the latter. Courts should

not assume that they are capable of deciphering the meaning of computer file metadata without

appropriate expertise or stipulations.

¶ 53 Perhaps Detective Wood, if asked, could have provided a competent interpretation

- 14 - of the metadata on the 11 image files in question and the conclusions that might be drawn about

the date of defendant’s original possession of these files. All that was available to the trial court,

however, was the metadata information found in People’s Exhibit 1, the entirety of which is

summarized in the following chart:

Count Date Created Date Modified Media Created

----- MP4 / Windows Media Files / Videos -----

6 2/17/2023 (11:32 a.m.) 2/2/2016 (10:54 a.m.)

8 2/17/2023 (11:34 a.m.) 9/17/2014 (11:28 p.m.) 9/17/2014 (3:28 p.m.)

13 2/17/2023 (11:34 a.m.) 2/24/2017 (10:17 p.m.)

17 2/17/2023 (11:34 a.m.) 8/5/2017 (9:59 p.m.)

----- JPG Files / Images -----

18 2/17/2023 (11:35 a.m.) 10/22/2019 (11:52 p.m.)

27 2/17/2023 (11:35 a.m.) 10/22/2019 (11:58 p.m.)

48 2/17/2023 (11:32 a.m.) 10/23/2019 (12:03 a.m.)

53 2/17/2023 (11:32 a.m.) 10/23/2019 (12:05 a.m.)

60 2/17/2023 (11:32 a.m.) 10/23/2019 (12:05 a.m.)

67 2/17/2023 (11:32 a.m.) 10/22/2019 (11:54 p.m.)

68 2/17/2023 (11:32 a.m.) 10/22/2019 (11:55 p.m.)

74 2/17/2023 (11:32 a.m.) 10/23/2019 (12:04 a.m.)

85 2/17/2023 (11:32 a.m.) 10/23/2019 (12:04 a.m.)

94 2/17/2023 (11:32 a.m.) 10/22/2019 (11:59 p.m.)

102 2/17/2023 (11:32 a.m.) 10/23/2019 (12:03 a.m.)

¶ 54 With no training or expertise in the interpretation of this information, an observer

might draw mistaken conclusions from a literal interpretation of the column headings. Does “Date

- 15 - created” mean the date on which the file first came into existence, its genesis? We know this cannot

be true, because here the “Date created” falls nearly two years after the material was seized from

defendant. Does “Date modified” mean the date on which defendant changed the content of the

file in some way? There is no allegation in the record that he did so. The inability to understand

the meaning of the dates reflected in the metadata demonstrates the need for appropriate expert

assistance, yet none was elicited from Wood on 14 of the 15 files.

¶ 55 Moreover, it is not possible to extrapolate Wood’s testimony with respect to the file

in count 13 so as to interpret the metadata from the 11 image files. The reason is that Wood’s

opinion concerning the video file at issue in count 13 was based on his awareness of two fields of

metadata for that file: both the “Date modified” and “Date created” fields. The only information

available to the trial court—and to us—is the “Date modified” field on People’s Exhibit 1. But

People’s Exhibit 1 is a copy of a copy; the “Date created” field was apparently overwritten in the

process of creating the DVD introduced into evidence. While the first copy of defendant’s flash

drive was made carefully by Wood with special equipment to ensure that none of the metadata was

overwritten, the DVD entered as People’s Exhibit 1 apparently was not. As noted above, Wood’s

interpretation of the metadata for the file correlating to count 3 was based on his knowledge of

matching information contained in both fields on defendant’s flash drive. Wood never testified

that the download date could be inferred from the “Date modified” field alone, i.e., the only

meaningful metadata field on People’s Exhibit 1. As it involved conclusions drawn from two fields

of metadata, Wood’s methodology was not susceptible to being extrapolated by the trial court,

which had just one. There is, then, no basis on which to find that these 11 files were obtained by

defendant via separate courses of conduct on any date other than April 1, 2021.

¶ 56 We note that, while we believe it would be a mistake to attempt to interpret the

- 16 - metadata from the relevant files ourselves, doing so would lead to the same conclusion about the

fact that the 11 files were obtained in a “single course of conduct.” The reason is that the “Date

modified” metadata fields for these 11 files reflect dates and times falling within 13 minutes of

each other. Consequently, even if these metadata dates were treated as the moment of defendant’s

acquisition, it would be unsupportable to characterize each of these downloads as a course of

conduct separate from the other 10.

¶ 57 In Thompson, the defendant was found guilty of 12 counts of unlawfully

disseminating child pornography after he sent four e-mails containing multiple lewd images to a

single individual during an e-mail exchange lasting less than 90 minutes. Thompson, 2022 IL App

(2d) 190950-U, ¶¶ 2, 42. On appeal, the appellate court concluded that the trial court’s finding that

the four e-mails did not constitute a “single course of conduct” was against the manifest weight of

the evidence. Id. ¶ 42. The same conclusion would be even more clearly appropriate here, where

the metadata evidence before the trial court, even if taken at face value, could at most support a

finding that all 11 files were obtained over the course of 13 minutes.

¶ 58 3. The Three Remaining Video Files

¶ 59 The question now turns to whether the record supports the trial court’s conclusion

that defendant’s acquisition of the three video files not discussed by Detective Wood constitute

three separate and independent courses of conduct. Again, it is fair to treat the default date of

possession as being April 1, 2021, absent competent evidence of a different date. The only other

available information is the file metadata. As reflected in the table above, the “Date modified”

field for the three video files relating to counts 6, 8, and 17 bears the following dates, respectively:

February 2, 2016; September 17, 2014; and August 5, 2017. Recall that Wood testified that

defendant obtained the file at issue in count 13 on or before February 24, 2017.

- 17 - ¶ 60 For the same reasons discussed above with respect to the 11 image files, we

conclude that the file metadata does not on its face support the conclusion that these 3 video files

were obtained by defendant on three separate dates between 2014 and 2017. Still, it is important

that these three video files not be considered in isolation; their relationship to the first date of

possession of other files may impact defendant’s sentence. For example, if the 3 video files

pertaining to counts 6, 8, and 17 were obtained by defendant at the same time he obtained the 11

image files, they would constitute a single course of conduct; in that case, his sentence on all 14

counts would be subject to the same 28-year cap.

¶ 61 C. The Effect on Defendant’s Sentence

¶ 62 Having reached conclusions about what the record supports with respect to whether

defendant’s offenses constitute separate courses of conduct, there is one additional legal issue to

be addressed before the effect of these conclusions on defendant’s sentence can be ascertained.

¶ 63 1. The Maximum Aggregate Sentence for a Single Course of Conduct

¶ 64 Defendant contends that the maximum term in prison to which he can be sentenced

for a single course of conduct is 14 years based on the maximum nonextended-term prison sentence

of 7 years because (1) the record does not show he was extended-term eligible and (2) “to include

the maximum extended term sentence, in a case where the defendant is not otherwise eligible for

an extended term, amounts to an unconstitutional end-run around the requirements of Apprendi [v.

New Jersey, 530 U.S. 466 (2000)], and Illinois law.”

¶ 65 Although we agree with defendant that the record does not show he was extended-

term eligible, we disagree with defendant’s contention that his extended-term eligibility has any

bearing on the maximum aggregate sentence he could receive under section 5-8-4(f)(2) of the

Code. Consistent with Apprendi, 530 U.S. at 490, Illinois law requires that “whenever a fact other

- 18 - than a prior conviction is considered to enhance a penalty beyond the statutory maximum, that fact

must be found to exist beyond a reasonable doubt by the trier of fact.” People v. Mimes, 2014 IL

App (1st) 082747-B, ¶ 26.

¶ 66 Defendant concedes “[t]here are cases holding that the maximum aggregate

sentence was based on the maximum extended term for the class of felony” (see People v. Pullen,

192 Ill. 2d 36, 46 (2000); People v. Woods, 131 Ill. App. 3d 51, 55 (1985); People v. Beck, 190 Ill.

App. 3d 748, 763 (1989); People v. Myrieckes, 315 Ill. App. 3d 478, 482 (2000)), but he argues

that because those cases predated Apprendi and subsequent changes to the Code, the maximum

aggregate sentence should not be calculated using the authorized extended-term sentence for Class

2 felonies. However, beyond the mere assertion that the legal landscape is now different, defendant

does not explain why the Apprendi decision affects the section 5-8-4(f)(2) calculation. Further, the

State points out that Thompson, which defendant cites favorably, calculated the maximum

aggregate sentence using the maximum extended-term sentence, even though the sentencing court

did not find that the defendant in Thompson was eligible for an extended-term sentence. See

Thompson, 2022 IL App (2d) 190950-U, ¶ 35 (citing Myrieckes, 315 Ill. App. 3d at 482).

¶ 67 In People v. Wagener, 196 Ill. 2d 269, 286 (2001), the Illinois Supreme Court

rejected a similar argument that the imposition of consecutive sentences pursuant to section 5-8-

4(b) of the Code was unconstitutional because it violated Apprendi. The court concluded as

follows:

“We find that Apprendi concerns are not implicated by consecutive

sentencing. It is a settled rule in this state that sentences which run consecutively to

each other are not transmuted thereby into a single sentence. [Citations.] Because

consecutive sentences remain discrete, a determination that sentences are to be

- 19 - served consecutively cannot run afoul of Apprendi, which only addresses sentences

for individual crimes. Accordingly, section 5-8-4(b) of the Code passes

constitutional muster.” Id.

¶ 68 As in Wagener, the present case does not concern an increase to defendant’s

individual sentences. Instead, section 5-8-4(f)(2) is a statutorily imposed limit on the total length

of time defendant can serve on his mandatory consecutive sentences. See Pullen, 192 Ill. 2d at 45

(“[T]he aim of section 5-8-4(c)(2) of the Code [(730 ILCS 5-8-4(c)(2) (West 1994))], and statutes

like it, is to limit the total length of consecutive sentences imposed on a defendant, while still fairly

punishing the defendant in relation to the severity of the crimes.” (Internal quotation marks

omitted.)). Because a determination of whether defendant will be subjected to consecutive

sentencing does not violate Apprendi, we see no reason why section 5-8-4(f)(2)’s limit on the total

length of a defendant’s sentence would operate differently. Accordingly, we calculate the

maximum aggregate prison sentence that defendant can serve for a single course of conduct based

on the maximum authorized extended-term sentence.

¶ 69 2. Calculating Defendant’s Sentence

¶ 70 We begin by addressing the sentence imposed on count 13. We have upheld the

trial court’s implicit finding that defendant’s possession of the material at issue in this charge

occurred on or before February 24, 2017, and that it is the result of a course of conduct separate

from any of the 14 other charges. Consequently, we affirm the trial court’s sentence of four years’

imprisonment imposed on count 13, to run consecutively to the remaining counts.

¶ 71 We have also concluded, however, that the trial court’s finding of separate courses

of conduct is unsustainable when it comes to the charges related to defendant’s possession of the

11 image files as charged in counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102. Because the two

- 20 - most serious felonies involved in this case are Class 2 felonies (possession of child pornography),

the maximum aggregate sentence for offenses that were part of a single course of conduct is 28

years in prison—twice the 14-year maximum for an extended-term sentence. See 720 ILCS 5/11-

20.1(c-5) (West 2020); 730 ILCS 5/5-4.5-35(a) (West 2020); Pullen, 192 Ill. 2d at 43 (concluding

the maximum aggregate sentence for two Class 2 felonies was 28 years in prison). Consequently,

we honor the statutory cap on consecutive sentences. Pursuant to our authority under Illinois

Supreme Court Rule 615(b)(4) (eff. Jan 1, 1967), we reduce defendant’s aggregate sentence on

these 11 charges to 28 years’ imprisonment. Because the record supports the conclusion that there

were years between defendant’s acquisition of the 11 image files and the single video file at issue

in count 13, the four-year sentence on the latter runs consecutively to the 28-year aggregate

sentence on the former.

¶ 72 Finally, we have determined that the trial court’s finding that the offenses relating

to the three video files at issue in counts 6, 8, and 17 constitute separate courses of conduct is

against the manifest weight of the evidence. We hesitate, however, to bundle these offenses into

the same course of conduct as the 11 image file possession charges—a conclusion that would bring

these charges under the existing 28-year cap—because such a conclusion is also not clearly

supported by the evidence. We are cognizant of the fact that, with appropriate expert interpretation,

the basis for finding that the actions at issue in counts 6, 8, and 17 were separate courses of conduct

may already be present within the metadata found in People’s Exhibit 1. In other words, unlike the

11 image possession counts, the metadata leaves the door open to the possibility that the three

video files were obtained by defendant on separate dates.

¶ 73 Reviewing courts must exercise cautiously their authority under Rule 615 to reduce

a defendant’s sentence. People v. Jones, 168 Ill. 2d 367, 378 (1995). Among the considerations in

- 21 - deciding whether to remand for resentencing is whether the parties may have “new or additional

evidence to offer upon remand.” Id. “A remand to the trial court affords the parties the opportunity

to present new or additional evidence.” People v. Quevedo, 403 Ill. App. 3d 282, 300 (2010). Here,

for example, the parties may wish to offer additional expert testimony concerning the conclusions

which can be drawn from the pertinent file metadata with respect to defendant’s original dates of

possession.

¶ 74 For this reason, we feel that the appropriate disposition with respect to counts 6, 8,

and 17 is to vacate the trial court’s imposition of consecutive sentences on these three counts and

remand solely for the purpose of addressing whether the consecutive sentences are subject to the

same 28-year cap applicable to the 11 image file counts. This will require the trial court to

determine whether any of the 3 video files constituted courses of conduct separate from

defendant’s April 1, 2021, possession of the 11 image files; if any are found to be separate courses

of conduct, the trial court’s four-year sentence on any such count would be made consecutive to

the sentences on the other counts without limitation. If, however, possession of any of these 3 files

is found to be the result of the same course of conduct which led to defendant’s possession of the

11 image files, the overall sentence for those counts would be subject to the same 28-year cap

applicable to the 11 image files (i.e., defendant would receive no additional years of incarceration

on such counts). Defendant’s aggregate sentence will be either 32, 36, 40, or 44 years, depending

on whether the trial court finds none, 1, 2, or all 3 of the 3 video files are subject to the same 28-

year cap applicable to the 11 image file counts. The trial court should then issue a corrected

mittimus accurately reflecting defendant’s aggregate sentence.

¶ 75 III. CONCLUSION

¶ 76 For the reasons stated, we affirm defendant’s four-year sentence on count 13; we

- 22 - modify defendant’s consecutive sentences on counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102

to an aggregate sentence of 28 years’ imprisonment (consecutive to the sentence on count 13); and

we vacate the imposition of consecutive sentences on counts 6, 8, and 17 and remand the cause for

the trial court to address whether the sentences on any of those 3 counts is subject to the same 28-

year cap that applies to the 11 image file counts.

¶ 77 Affirmed in part, modified in part, and vacated in part; cause remanded with

directions.

¶ 78 JUSTICE STEIGMANN, specially concurring in part and dissenting in part:

¶ 79 I concur in the majority’s disposition in two respects. First, I agree that the

consecutive sentences imposed on the 11 counts based on possession of illicit image files (counts

18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102) are properly capped at a total of 28 years. Second,

I agree with the majority that the record supports the trial court’s conclusion that count 13, based

on possession of an illicit video file, is not part of the same “single course of conduct” as the

previously mentioned 11 counts.

¶ 80 I respectfully disagree, however, with the conclusion of my distinguished

colleagues that the record does not support separate course-of-conduct findings for counts 6, 7,

and 17. In addition, notwithstanding my disagreement with their conclusion regarding the number

of separate courses of conduct supported by the record, I disagree with their decision to remand

the case for the presentation of additional evidence as to only counts 6, 7, and 17.

¶ 81 A. The Evidence

¶ 82 I view Wood’s testimony to have adequately apprised the trial court (and this court

for that matter) of the significance of the dates in People’s Exhibit 1—specifically, the dates listed

in the “Date modified” field (hereinafter modified dates) and “Date created” field (hereinafter

- 23 - created dates). Wood testified that the “created and modified date” for the count 13 video was

February 24, 2017, which meant it was “created and modified on [the flash drive] on or before that

date.” He then explained what “created” and “modified” meant, in part, by way of the following

example:

“So, I will use a picture, for example. If I take a picture, it is going to have

a created, modified and last access date. If I crop that image on the same day I

created it, I have modified that image, so the stamp will be different. So, if I take a

picture of myself, for example, and I put it on my computer, it will have created a

modified access. Tomorrow, I go into it and I crop it, the image is still there, but it

has been modified. And it was modified the following day. So, the created date that

was on the computer was the day I put it on the computer. The date it was modified

was the day that I changed any data within that artifact.”

¶ 83 Wood’s testimony means that the modified dates correspond to the last time a file

was modified on the flash drive. Regarding the count 13 video file in People’s Exhibit 1, he also

testified that the modified date and created date—the date the file came into existence on the flash

drive—was February 24, 2017. I note that Wood’s testimony was not that “defendant created and

modified the file” on the device on or before that date; instead, he testified, “So the best I can tell

you is that item of evidence was created and modified on that device on or before that date.”

Accordingly, the trial court had to infer, based on the totality of the evidence and circumstances

known to it, whether defendant was the person who modified and created the count 13 file in the

flash drive on or before that date. In other words, was that date the earliest known date of

possession? The operative inference being as follows: If defendant modified the file on a certain

date, then he possessed the file on that date.

- 24 - ¶ 84 The record shows that (1) the 15 files were located in defendant’s flash drive, which

he admits he had for at least some amount of time prior to April 1, 2021; (2) the files were stored

in the flash drive along with hundreds of other files containing child pornography; (3) defendant

stated that he had struggled for years with his addiction to child pornography and sought out videos

of underage girls; (4) he stated that his addiction culminated in his downloading of “the pictures

that [he was] charged with possessing” as a single download, after he stopped receiving photos

from L.M.; (5) he stated that when he downloaded the pictures, he “was shocked and disgusted”

“[and] promptly exited the file ***. And [he] did not view and go into that folder again”; (6) he

stated that he would masturbate to child pornography; and (7) the victim stated that she was

groomed by defendant since she was 13 years old.

¶ 85 This evidence supports the inference that the modified dates for the 15 files in

People’s Exhibit 1 correspond to the dates defendant gained possession of those files.

¶ 86 Starting with the 11 image files, People’s Exhibit 1 shows that the 11 image files

have modified dates of October 22-23, 2019, and were modified over a period of 13 minutes. Those

times and dates comport with defendant’s statement in allocution that he downloaded “the pictures

that [he was] charged with possessing” as one file after he stopped receiving photos from L.M.

Importantly, those 11 image files are the only “pictures” that defendant was charged with

possessing and are the only files in People’s Exhibit 1 that show a modified date after defendant’s

and L.M.’s correspondence from May 2017 through September 2017 (supra ¶ 16).

¶ 87 The remaining four files in People’s Exhibit 1 are all video files that have modified

dates of September 2014, February 2016, February 2017, and August 2017, which again comports

with the record. L.M. was born in June 2002, meaning the pornographic photos of her that

defendant received from May 2017 through September 2017 were taken when she was 14 and 15

- 25 - years old. She stated that his “grooming” of her began when she was 13 years old, almost two

years earlier than when those photos were taken. Clearly, defendant’s sexual interest in underage

girls began years earlier than 2017, based on his predation of L.M. alone.

¶ 88 Accepting as true defendant’s claim that he did not again open the folder on the

flash drive that contained the 11 photos after downloading them, his statements that he sought out

videos of child pornography, masturbated to child pornography, and struggled for years with the

addiction line up with the modified dates in People’s Exhibit 1, which range from 2014 to 2019.

Those files happen to be video files, which defendant said he had sought out. Also, considering

the volume of pornographic material in the flash drive and defendant’s tacit admission that he

possessed the files for some time prior to April 1, 2021, the trial court—at the very least—could

reasonably infer that the five different modified dates in People’s Exhibit 1 show five separate

courses of conduct.

¶ 89 Accordingly, I would affirm the trial court’s order and modify the sentence to

reflect those five separate courses of conduct. This would mean that defendant’s sentence would

become 44 years in prison, as I explain in my conclusion (infra ¶ 97).

¶ 90 B. Remand

¶ 91 In addition, because I agree with the majority that “it is fair to treat the default date

of possession as being April 1, 2021, absent competent evidence of a different date” (supra ¶ 59),

I believe that this case should not be remanded for additional evidence on only counts 6, 7, and 17.

In keeping with the majority’s conclusions about the evidentiary value of the metadata, on remand,

we should also permit additional evidence pertaining to the 11 counts based on possession of illicit

image files.

¶ 92 If, as the majority appears to indicate, the only reasonable conclusion about the

- 26 - evidence to draw from Wood’s testimony is that the count 13 video file was downloaded at an

earlier date than the remaining 14 files, then those 14 files should be treated similarly to one

another. In other words, because the modified dates in People’s Exhibit 1 do not matter, there is

no basis for this court to conclude that possession of those 14 files was not part of the same

“default” course of conduct on April 1, 2021.

¶ 93 The majority concludes,

“As [Wood’s testimony] involved conclusions drawn from two fields of metadata,

Wood’s methodology was not susceptible to being extrapolated by the trial court,

which had just one. There is, then, no basis on which to find that these 11 files were

obtained by defendant via separate courses of conduct on any date other than April

1, 2021.” (Emphasis omitted.) Supra ¶ 55.

¶ 94 Despite that conclusion, the majority appears to extrapolate from Wood’s testimony

and the metadata a holding that the 11 image files are part of a single course of conduct. The

majority then, without explanation, singles out the counts 6, 8, and 17 video files as potentially

being part of separate courses of conduct. This distinction seems wholly at odds with the logic of

their decision.

¶ 95 The only reason I see for the distinction is that the majority presupposes that

additional evidence on those counts would confirm what the modified dates in People’s Exhibit 1

shows: The images were downloaded as a single course of conduct because they were downloaded

over a 13-minute period of time (supra ¶ 57). See Thompson, 2022 IL App (2d) 190950-U, ¶ 42.

However, the reasoning in the majority’s disposition is contrary to that presupposition. If taken as

true that the trial court or this court is unable to discern the meaning of the metadata from Wood’s

testimony (a point with which I strongly disagree), then the metadata for all the remaining 14

- 27 - counts should be of no consequence to this court’s decision.

¶ 96 C. Conclusion

¶ 97 The foregoing analysis leads me to the following conclusions about defendant’s

appropriate sentence. First, with respect to the 11 charges related to possession of illicit images

(counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102), I concur with the majority that defendant’s

consecutive sentences for these offenses are capped at 28 years. Second, Wood’s testimony,

defendant’s testimony, People’s Exhibit 1, and the circumstances of defendant’s possession

provide a basis for the trial court to have concluded that the charges reflected in counts 6, 7, 13,

and 17 were part of separate courses of conduct from one another and the 11 image-possession

offenses. Accordingly, I would modify defendant’s aggregate sentence to 44 years in prison to

reflect the offenses’ having been committed as five separate courses of conduct—4 years in prison

each for counts 6, 7, 13, and 17, to be served consecutively to the 28-year maximum aggregate

sentence for the remaining 11 counts.

- 28 -