People v. Schneider

2024 IL App (4th) 230524-U

Opinion

NOTICE 2024 IL App (4th) 230524-U This Order was filed under FILED

NO. 4-23-0524 July 10, 2024 Supreme Court Rule 23 and is Carla Bender

not precedent except in the IN THE APPELLATE COURT 4th District Appellate limited circumstances allowed Court, IL under Rule 23(e)(1).

OF ILLINOIS

FOURTH DISTRICT

THE PEOPLE OF THE STATE OF ILLINOIS, ) Appeal from the Plaintiff-Appellee, ) Circuit Court of v. ) McLean County MICHAEL D. SCHNEIDER, ) No. 21CF711 Defendant-Appellant. )

) Honorable

) William A. Yoder,

) Judge Presiding.

JUSTICE DOHERTY delivered the judgment of the court.

Justice Harris concurred in the judgment.

Justice Steigmann specially concurred in part and dissented in part.

ORDER

¶1 Held: The appellate court affirmed defendant’s sentence on 1 count, modified his consecutive sentences on 11 counts by applying a statutory cap of 28 years, and remanded the matter back to the trial court for resentencing on 3 counts.

¶2 In December 2022, defendant Michael Schneider entered a partially negotiated plea of guilty to 15 Class 2 felony counts of possession of child pornography (720 ILCS 5/11-20.1(a)(6) (West 2020)). In February 2023, the trial court conducted a sentencing hearing at which defendant contended the maximum aggregate sentence was capped because all 15 counts to which he pleaded guilty stemmed from a single course of conduct. The court disagreed and sentenced him to consecutive sentences of 4 years in prison on each count, resulting in an aggregate sentence of 60 years in prison.

¶3 Defendant appeals, arguing that his 60-year aggregate sentence violated section 5-

8-4(f) of the Unified Code of Corrections (Code) (730 ILCS 5/5-8-4(f)(2) (West 2020)) because his convictions for possession of child pornography all stemmed from one course of conduct and are, therefore, subject to a statutory cap on his aggregate sentence. We hold that: (1) the trial court’s finding that the offense in count 13 arose from a separate course of conduct from that giving rise to the other charges is not against the manifest weight of the evidence; (2) the consecutive sentences imposed on counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102 must be modified to reflect that they are subject to a cumulative cap of 28 years’ imprisonment; and (3) the record does not support the conclusion that counts 6, 8, and 17 stemmed from separate courses of conduct, so we vacate the imposition of those sentences consecutively and remand the matter for resentencing.

¶4 I. BACKGROUND

¶5 A. The Charges

¶6 In July 2021, defendant was charged with a variety of offenses in two separate cases. In McLean County case No. 21-CF-711, defendant was charged with 130 counts of possession of child pornography, all Class 2 felonies (720 ILCS 5/11-20.1(a)(6) (West 2020)), based on 130 photos and videos found in his possession on April 1, 2021. In McLean County case No. 21-CF-712, defendant was charged with various sex crimes, including criminal sexual assault, a Class 1 felony (id. § 11-1.20(a)(4)), and production of child pornography, a Class 1 felony (id. § 11-20.1(a)(1)(vii)), all of which involved L.M., defendant’s underage piano student. Both cases were considered simultaneously by the trial court, but only case No. 21-CF-711 is at issue in this appeal.

¶7 B. The Guilty Plea

¶8 In December 2022, defendant entered a guilty plea to (1) 15 counts of possession of child pornography—namely, counts 6, 8, 13, 17, 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102

3

in case No. 21-CF-711—which did not include photos of L.M., (2) 1 count of production of child pornography for taking a sexually explicit photograph of L.M., and (3) 2 counts of criminal sexual assault of L.M. In exchange, the State agreed to dismiss all other counts against him in both cases and to recommend a 20-year prison sentence in case No. 21-CF-712. Defendant’s guilty plea to the 15 counts in case No. 21-CF-711 was an open plea.

¶9 At the guilty plea hearing, the trial court admonished defendant regarding the plea agreement, charges, and ranges of punishment in case No. 21-CF-712. The court then admonished defendant regarding case No. 21-CF-711, explaining that each offense was a Class 2 felony, punishable by a minimum of three, or a maximum of seven, years in prison, to be served consecutively. Further, the court stated that the offenses were all separate and distinct acts. The court did not admonish defendant that he was eligible for extended-term sentencing, and the State did not indicate that it was pursuing extended-term sentencing.

¶ 10 As the factual basis for defendant’s guilty plea in case No. 21-CF-712, the State proffered that on multiple occasions, starting in 2017, defendant sexually assaulted L.M., who was between 13 and 15 years old at the time, and also took sexually explicit photos of her.

¶ 11 As the factual basis for defendant’s guilty plea in case No. 21-CF-711, the State proffered the following:

“Next, Your Honor, in regards to [case No.] 21 CF 711, if that case were to proceed to trial, the State would provide sufficient evidence to show that the Normal Police Department, after being notified by L.M. that her music teacher the defendant *** had sexually abused her over a course of years and had disclosed that they had exchanged illicit photographs, a search warrant was [obtained for]

that residence. On April 1st of 2021[,] in [the execution of] that search warrant[,]

4

22 items were seized including multiple electronic devices. One of those devices was a flash drive belonging to the defendant. In that flash drive in a folder[,] which was labeled holiday spectacular 2015, contained another folder that was labeled show files. In the show files folder multiple images and videos of suspected child pornography were identified.”

¶ 12 The State then described the content of each image and video relevant to defendant’s guilty plea and stated that an expert had opined that the images and videos depicted minor children.

¶ 13 The trial court accepted the factual bases and defendant’s guilty plea.

¶ 14 C. The Sentencing Hearing

¶ 15 In February 2023, the trial court conducted a sentencing hearing in case Nos. 21- CF-711 and 21-CF-712, at which the court received, among other things, (1) a presentence investigation report, (2) a sex offender evaluation, (3) the testimony of Detective Jason Wood, (4) victim impact statements, and (5) the State’s exhibits.

¶ 16 People’s Exhibit 1 contained the 15 media files underlying the 15 counts of possession of child pornography in case No. 21-CF-711. The files were located inside a folder that, when opened, showed a list of the 15 files, which included the file names and fields labeled “Date modified” and “Date created” for each file. People’s Exhibit 2 contained the photographs of L.M. and correspondence between defendant and L.M. from May 2017 through September 2017. Defendant stipulated to both of these exhibits being admitted into evidence.

¶ 17 1. The Sex Offender Evaluation

¶ 18 The sex offender evaluation contained the evaluator’s report of an interview with defendant, during which he was asked about the flash drive containing the child pornography. The

5

report stated as follows:

“[Defendant] said that [L.M.] started sending him pictures of her trying on different outfits. He admitted that he bought her alcohol and she then started to offer him naked pictures of herself if he would continue to purchase the alcohol. He indicated that he continued to buy alcohol for her, and she would send him the pictures. He said that this was when he got interested in child pornography. He admitted that he sought out and downloaded the material and saved it in a [flash] drive. He indicated that he would masturbate to his material.”

¶ 19 2. Detective Jason Wood

¶ 20 Detective Jason Wood of the Normal Police Department testified that he forensically examined a flash drive seized from defendant’s home on April 1, 2021. Wood utilized a device which allowed him to read the contents of a flash drive without writing any new information. This process created a “bit for bit” duplicate image of defendant’s flash drive.

¶ 21 Wood examined the metadata for a file titled “ESP732.MP4”, which was the image that formed the basis of count 13 of case No. 21-CF-711. Wood testified that both the “created” and “modified” dates for this image were February 24, 2017. Regarding what “created” and “modified” meant, Wood gave a hypothetical example, stating, “So, the created date that was on the computer was the day I put it on the computer. The date it was modified was the day that I changed any data within that [file].” He explained that, unless some other source could show when the item was stored on the flash drive, that the “created and modified” date of February 24, 2017, showed that the item was “created and modified on [the flash drive] on or before that date.” Wood did not discuss the evidence underlying the other 14 counts in case No. 21-CF-711.

¶ 22 Because the record does not provide a definition for “metadata,” we find the

6

following definition in 126 Am. Jur. 3d Proof of Facts 281 §§ 1, 4 (April 2024 Update) helpful.

“Metadata is data typically stored electronically that describes characteristics of electronically stored information (ESI) and is found in different places in different forms. Metadata can be supplied by software applications, users, or a computer's file system. Metadata can describe how, when, and by whom ESI was collected, created, accessed, modified, and how it is formatted.

***

File system metadata consists of logs and other logistical information generated by an operating system to track the demographics (name, size, location, usage, etc.) of the ESI and not embedded within but stored externally from the ESI. Examples of file system metadata that is frequently requested in litigation include the DateModified, DateAccessed, and DateCreated fields, known as MAC dates or fields.”

¶ 23 3. The Parties’ Arguments

¶ 24 The State recommended the maximum sentence of 7 years on each count in case No. 21-CF-711 and recommended 20 years in prison for the three counts in case No. 21-CF-712. The State highlighted defendant’s statements in the sex offender evaluation that he became addicted to child pornography after L.M. sent him topless photos of herself, which led to his later seeking out the pornographic images of other minors that the police found on his flash drive. The State asserted that defendant’s claim that he had acquired all of the files at the same time was not credible because Wood’s testimony established that the files were last created or modified in February 2017, while the photos of L.M. were from May 2017 through September 2017.

¶ 25 Defense counsel responded that L.M. had been defendant’s student for years prior

7

to 2017, which meant other photos could exist that were not in the record that would corroborate defendant’s statements. He further pointed out that (1) all of the images were found on one flash drive and that defendant was convicted of possessing them on April 1, 2021, and (2) Wood’s testimony provided only the February 2017 date for a single file’s creation or last modification. Citing section 5-8-4(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2020)), defense counsel argued that because there was no evidence that the flash drive contained material acquired at different times, the possession of the child pornography constituted a single course of conduct with no substantial change in the criminal objective. Defense counsel asserted that because there was only a single course of conduct, section 5-8-4(f)(2) capped the maximum allowable sentence.

¶ 26 The State replied that the Code allows each image to be charged as a single and separate violation and requires consecutive sentences. The State further argued that defendant had downloaded hundreds of images “over a period of time” and his “intent of possession was over many months, if not years.”

¶ 27 4. Defendant’s Statement in Allocution

¶ 28 In allocation, defendant stated that he never sought out child pornography until L.M. sent him photographs through Snapchat (a smartphone application for sending messages, photos, and videos). He stated that L.M. sent him additional photos over time but eventually stopped. He then struggled with his child pornography addiction, leading him to seek videos of underage girls, which “resulted in acquiring the pictures that [he was] charged with possessing.” Defendant alleged he downloaded the photos as one password protected “zip” file. He looked at those photos once and never again.

¶ 29 5. The Sentence

¶ 30 After considering the evidence in mitigation and aggravation, the trial court noted

8

that defendant was “being sentenced on 18 very serious felony offenses; three Class 1 felony offenses in 21-CF-712; and 15 Class 2 felony offenses in 21-CF-711.” The court then sentenced defendant on those offenses as follows:

“The defendant *** possessed photographs of [L.M.] in sexual poses and possessed numerous images of child pornography. He has pled guilty to one count of photographing the victim in [case No. 21-CF-712] and/or possessing a photograph of the victim and 15 counts of possession of child pornography [in case No. 21-CF-711].

***

I find that the defendant’s statement in relation to a single download is not credible. As it relates to testimony of Det. Wood, images at different—I think it was metadata creation dates. And I believe that these images of child pornography are not part of a single course of conduct without a change in the criminal conduct of the—criminal nature of the conduct.

***

As it relates to the 15 counts in 21-CF-711, these are Counts 6, 8, 13, 17, 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102, the Court, as I previously mentioned, believes that these were all separate and distinct acts and part of a separate course of conduct. And the Court believes that an appropriate sentence on each of those counts is four years to be followed up by a period of mandatory supervised release at three years to life.”

¶ 31 Accordingly, the trial court sentenced defendant to 15 consecutive four-year sentences—an aggregate sentence of 60 years’ imprisonment—on the 15 counts of possession of

9

child pornography in case No. 21-CF-711.

¶ 32 D. The Motion to Reconsider

¶ 33 Defendant filed a motion to reconsider the sentence, realleging that the maximum allowable sentence was 28 years because the 15 counts of possession of child pornography constituted a single course of conduct. At a hearing on defendant’s motion, defendant argued that (1) the State had charged only one date for the date of possession in all 15 counts, (2) the images were all stored in a single location—namely, the flash drive, and (3) the images all appeared to originate from the same source based on a watermark the images bore. Because nothing indicated that the creation date of the images was different for any of the images and all the counts alleged possession on April 1, 2021, defendant asserted that the offenses were part of a single course of conduct with no change in the criminal objective.

¶ 34 Defendant asserted that his case was similar to People v. Thompson, 2022 IL App (2d) 190950-U, in which the appellate court concluded that a 72-year aggregate sentence for disseminating child pornography, a Class 1 felony (720 ILCS 5/11-20.1(a)(2) (West 2016)), violated section 5-8-4(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2016)) because the acts of sending multiple e-mails containing child pornography within a short time period constituted a single course of conduct punishable by a maximum aggregate sentence of 60 years in prison.

¶ 35 The State responded that (1) the legislative history did not support defense counsel’s argument and (2) the only evidence that the images were “downloaded with one single click of a button was *** [d]efendant’s statement in allocution.” However, the State pointed out that the sex offender evaluation was evidence the trial court could consider, and it showed that defendant looked at child pornography on multiple occasions and was not truthful when he said that he became addicted to child pornography only after L.M. sent him photos of herself. Wood’s

10

testimony showed that the media file on the flash drive was acquired at a time earlier than when he received those photos from L.M. The State continued, “When looking at the images and the videos of the metadata it is clear that these were downloaded on multiple different dates over months and months and months of time, and so to suggest to the Court [otherwise] is inappropriate.”

¶ 36 The trial court concluded that defendant’s possession of the images in the flash drive was not a single course of conduct, explaining as follows:

“So the question is in the court’s mind was the course of conduct—would the acts conducted or taken in a—a series of acts taken with the same mental or accompanying mental state?

So, the Defendant has indicated his mental state at the time that he downloaded many of the—he was alleged to have downloaded many of the child pornographic images, that being the mental state of an addiction caused by the victim sending him partially clothed or nude images.

But the image—there was testimony at the sentencing hearing that one of the images at least pre-dated any images from the victim being sent to the Defendant. And so it would naturally flow from that that there was a different mental state that caused the downloading of that image and therefore by definition not part of the same course of conduct. And as a result of that, regardless of whether the legislature intended for these to all be mandatorily consecutive and with no aggregate limitation—regardless of that under the argument presented pursuant to statute that allows for an aggregate maximum of the two most—the maximum of the two most serious charges that only applies where the offenses were committed

11

as part of a single course of conduct, and there is evidence in this case that that is not the case, that there was not—these acts were not committed as part of a single course of conduct during which there was no substantial change in the nature of the criminal objective.

Therefore, the Court believes that it made the appropriate ruling at the time of sentencing imposing mandatorily consecutive sentences on all of the counts in [case No. 21-CF-711], and the motion to reduce the sentence or modify the sentence is going to be denied.”

¶ 37 This appeal followed.

¶ 38 II. ANALYSIS

¶ 39 On appeal, defendant argues that his 60-year aggregate sentence violated section 5- 8-54(f)(2) of the Code (730 ILCS 5/5-8-4(f)(2) (West 2020)) because his convictions for possession of child pornography all stemmed from a single course of conduct, thereby triggering application of the statutory cap on the aggregate sentence.

¶ 40 A. Applicable Law—Cap on Mandatory Consecutive Sentences

¶ 41 The issues in this case all involve the proper application of different subsections of section 5-8-4 of the Code, the first of which requires the imposition of consecutive sentences for specified offenses. 730 ILCS 5/5-8-4(d) (West 2020). Here, defendant concedes that the Code requires the imposition of consecutive sentences for all 15 offenses to which he pleaded guilty in the instant case.

¶ 42 The second relevant subsection, section 5-8-4(f), is the one which provides for a “cap” on the aggregate length of the consecutive sentences under certain circumstances:

“For sentences imposed under the law in effect on or after February 1, 1978, the

12

aggregate of consecutive sentences for offenses that were committed as part of a single course of conduct during which there was no substantial change in the nature of the criminal objective shall not exceed the sum of the maximum terms authorized under Article 4.5 of Chapter V for the 2 most serious felonies involved, but no such limitation shall apply for offenses that were not committed as part of a single course of conduct during which there was no substantial change in the nature of the criminal objective.” Id. § 5-8-4(f)(2).

“ ‘The test to be used in determining whether a particular offense is part of a single course of conduct, during which there was no *** [substantial] change in the nature of the criminal objective, is the independent motivation test; that is, were the defendant’s acts independently motivated?’ ” People v. Wilder, 325 Ill. App. 3d 987, 1001 (2001). “If there was a substantial change in the nature of the criminal objective, the defendant’s offenses are part of an ‘unrelated course of conduct.’ ” Id.

¶ 43 Here, there seems to be no suggestion that there was a substantial change in defendant’s criminal objective across all 15 counts, i.e., to obtain and possess child pornography. The question is whether, as the trial court found, each one of the 15 counts relates to a course of conduct separate from the others, or whether some or all counts might relate to “a single course of conduct.” 730 ILCS 5/5-8-4(f)(2) (West 2020).

¶ 44 B. The Trial Court’s Finding of No “Single Course of Conduct”

¶ 45 We begin our analysis by noting that the 15 illicit computer files at issue were all found on a single device in defendant’s possession on a single date: April 1, 2021. In order to construe defendant’s possession as separate acts (i.e., not a “single course of conduct”), it becomes necessary to find in the record some basis to conclude that he possessed the files, or at least some

13

of them, at an earlier date.

¶ 46 The trial court found that defendant’s acquisition of the 15 files at issue was “not part of a single course of conduct without a change in the *** criminal nature of the conduct.” The court did not explicitly share its reasoning for this conclusion. The only possible basis in the record for such a finding would be the testimony of detective Wood or the file metadata reflected in People’s Exhibit 1. We find that the issues presented are not identical with respect to each of the computer files at issue, so we examine the basis for the trial court’s findings as to three separate groups: (1) the single video file supporting count 13; (2) the 11 image files; and (3) the 3 remaining video files. We undertake our review with the understanding that whether a defendant’s actions constitute a single course of conduct or are part of an unrelated course of conduct is a question of fact for the trial court, and a reviewing court will defer to the trial court’s determination unless it is against the manifest weight of the evidence. People v. Robinson, 2015 IL App (1st) 130837,

¶ 102. “A finding is against the manifest weight of the evidence only if the opposite conclusion is clearly evident or if the finding itself is unreasonable, arbitrary, or not based on the evidence presented.” People v. Deleon, 227 Ill. 2d 322, 332 (2008).

¶ 47 1. The Video File—Count 13

¶ 48 At the sentencing hearing, the State called Detective Wood to provide his technical interpretation of the metadata retrieved from the files on defendant’s flash drive. However, Wood offered an opinion as to only one of the 15 files at issue, the video file relating to count 13 of the indictment. The State asked Wood about both the “Date created” and “Date modified” information for this file, and his answer suggested that the date reflected for each was the same: February 24, 2017. He then opined that this information meant that the file “was created and modified” on defendant’s flash drive “on or before” February 24, 2017.

14

¶ 49 There were other questions not asked of Wood, such whether the “Date modified” corresponding to each file could have been “inherited” (i.e., whether the date was imprinted on the file before defendant obtained it). He was not asked what effect downloading the files via a “zip” file would have had on the dates contained in the metadata. Finally, he was also not asked the significance of the “Media created” date listed in the metadata for only one file, the video file relating to count 8. Regardless, it is clear enough that Wood’s testimony was sufficient to support the trial court’s implicit conclusion that defendant first obtained the video file relating to count 13 “on or before” February 24, 2017, i.e., prior to the April 1, 2021, date on which all 15 files were seized. At least as to the file relating to count 13, this is sufficient to support the court’s conclusion that defendant’s possession of that file is not part of a “single course of conduct” that includes the other 14 files at issue.

¶ 50 2. The 11 Image Files

¶ 51 As noted above, the 11 image files were seized from defendant on April 1, 2021. Absent evidence that individual files within that group of 11 were acquired on a different date or dates, one would have to conclude that the offenses arising from possession of these files were part of a “single course of conduct” that occurred on April 1, 2021.

¶ 52 Stated more succinctly, the dates stored in the computer file metadata of a photograph or video on a flash drive may reflect the actions of the possessor of the flash drive, while other dates may reflect actions taken by different people that affected the file; a key question will often be whether a date contained in metadata reflects the former or the latter. Courts should not assume that they are capable of deciphering the meaning of computer file metadata without appropriate expertise or stipulations.

¶ 53 Perhaps Detective Wood, if asked, could have provided a competent interpretation

15

of the metadata on the 11 image files in question and the conclusions that might be drawn about the date of defendant’s original possession of these files. All that was available to the trial court, however, was the metadata information found in People’s Exhibit 1, the entirety of which is summarized in the following chart:

Count Date Created Date Modified Media Created ----- MP4 / Windows Media Files / Videos -----

6 2/17/2023 (11:32 a.m.) 2/2/2016 (10:54 a.m.)

8 2/17/2023 (11:34 a.m.) 9/17/2014 (11:28 p.m.) 9/17/2014 (3:28 p.m.)

13 2/17/2023 (11:34 a.m.) 2/24/2017 (10:17 p.m.)

17 2/17/2023 (11:34 a.m.) 8/5/2017 (9:59 p.m.)

----- JPG Files / Images -----

18 2/17/2023 (11:35 a.m.) 10/22/2019 (11:52 p.m.)

27 2/17/2023 (11:35 a.m.) 10/22/2019 (11:58 p.m.)

48 2/17/2023 (11:32 a.m.) 10/23/2019 (12:03 a.m.)

53 2/17/2023 (11:32 a.m.) 10/23/2019 (12:05 a.m.)

60 2/17/2023 (11:32 a.m.) 10/23/2019 (12:05 a.m.)

67 2/17/2023 (11:32 a.m.) 10/22/2019 (11:54 p.m.)

68 2/17/2023 (11:32 a.m.) 10/22/2019 (11:55 p.m.)

74 2/17/2023 (11:32 a.m.) 10/23/2019 (12:04 a.m.)

85 2/17/2023 (11:32 a.m.) 10/23/2019 (12:04 a.m.)

94 2/17/2023 (11:32 a.m.) 10/22/2019 (11:59 p.m.)

102 2/17/2023 (11:32 a.m.) 10/23/2019 (12:03 a.m.)

¶ 54 With no training or expertise in the interpretation of this information, an observer might draw mistaken conclusions from a literal interpretation of the column headings. Does “Date

16

created” mean the date on which the file first came into existence, its genesis? We know this cannot be true, because here the “Date created” falls nearly two years after the material was seized from defendant. Does “Date modified” mean the date on which defendant changed the content of the file in some way? There is no allegation in the record that he did so. The inability to understand the meaning of the dates reflected in the metadata demonstrates the need for appropriate expert assistance, yet none was elicited from Wood on 14 of the 15 files.

¶ 55 Moreover, it is not possible to extrapolate Wood’s testimony with respect to the file in count 13 so as to interpret the metadata from the 11 image files. The reason is that Wood’s opinion concerning the video file at issue in count 13 was based on his awareness of two fields of metadata for that file: both the “Date modified” and “Date created” fields. The only information available to the trial court—and to us—is the “Date modified” field on People’s Exhibit 1. But People’s Exhibit 1 is a copy of a copy; the “Date created” field was apparently overwritten in the process of creating the DVD introduced into evidence. While the first copy of defendant’s flash drive was made carefully by Wood with special equipment to ensure that none of the metadata was overwritten, the DVD entered as People’s Exhibit 1 apparently was not. As noted above, Wood’s interpretation of the metadata for the file correlating to count 3 was based on his knowledge of matching information contained in both fields on defendant’s flash drive. Wood never testified that the download date could be inferred from the “Date modified” field alone, i.e., the only meaningful metadata field on People’s Exhibit 1. As it involved conclusions drawn from two fields of metadata, Wood’s methodology was not susceptible to being extrapolated by the trial court, which had just one. There is, then, no basis on which to find that these 11 files were obtained by defendant via separate courses of conduct on any date other than April 1, 2021.

¶ 56 We note that, while we believe it would be a mistake to attempt to interpret the

17

metadata from the relevant files ourselves, doing so would lead to the same conclusion about the fact that the 11 files were obtained in a “single course of conduct.” The reason is that the “Date modified” metadata fields for these 11 files reflect dates and times falling within 13 minutes of each other. Consequently, even if these metadata dates were treated as the moment of defendant’s acquisition, it would be unsupportable to characterize each of these downloads as a course of conduct separate from the other 10.

¶ 57 In Thompson, the defendant was found guilty of 12 counts of unlawfully disseminating child pornography after he sent four e-mails containing multiple lewd images to a single individual during an e-mail exchange lasting less than 90 minutes. Thompson, 2022 IL App (2d) 190950-U, ¶¶ 2, 42. On appeal, the appellate court concluded that the trial court’s finding that the four e-mails did not constitute a “single course of conduct” was against the manifest weight of the evidence. Id. ¶ 42. The same conclusion would be even more clearly appropriate here, where the metadata evidence before the trial court, even if taken at face value, could at most support a finding that all 11 files were obtained over the course of 13 minutes.

¶ 58 3. The Three Remaining Video Files

¶ 59 The question now turns to whether the record supports the trial court’s conclusion that defendant’s acquisition of the three video files not discussed by Detective Wood constitute three separate and independent courses of conduct. Again, it is fair to treat the default date of possession as being April 1, 2021, absent competent evidence of a different date. The only other available information is the file metadata. As reflected in the table above, the “Date modified” field for the three video files relating to counts 6, 8, and 17 bears the following dates, respectively: February 2, 2016; September 17, 2014; and August 5, 2017. Recall that Wood testified that defendant obtained the file at issue in count 13 on or before February 24, 2017.

18

¶ 60 For the same reasons discussed above with respect to the 11 image files, we conclude that the file metadata does not on its face support the conclusion that these 3 video files were obtained by defendant on three separate dates between 2014 and 2017. Still, it is important that these three video files not be considered in isolation; their relationship to the first date of possession of other files may impact defendant’s sentence. For example, if the 3 video files pertaining to counts 6, 8, and 17 were obtained by defendant at the same time he obtained the 11 image files, they would constitute a single course of conduct; in that case, his sentence on all 14 counts would be subject to the same 28-year cap.

¶ 61 C. The Effect on Defendant’s Sentence

¶ 62 Having reached conclusions about what the record supports with respect to whether defendant’s offenses constitute separate courses of conduct, there is one additional legal issue to be addressed before the effect of these conclusions on defendant’s sentence can be ascertained.

¶ 63 1. The Maximum Aggregate Sentence for a Single Course of Conduct

¶ 64 Defendant contends that the maximum term in prison to which he can be sentenced for a single course of conduct is 14 years based on the maximum nonextended-term prison sentence of 7 years because (1) the record does not show he was extended-term eligible and (2) “to include the maximum extended term sentence, in a case where the defendant is not otherwise eligible for an extended term, amounts to an unconstitutional end-run around the requirements of Apprendi [v. New Jersey, 530 U.S. 466 (2000)], and Illinois law.”

¶ 65 Although we agree with defendant that the record does not show he was extended- term eligible, we disagree with defendant’s contention that his extended-term eligibility has any bearing on the maximum aggregate sentence he could receive under section 5-8-4(f)(2) of the Code. Consistent with Apprendi, 530 U.S. at 490, Illinois law requires that “whenever a fact other

19

than a prior conviction is considered to enhance a penalty beyond the statutory maximum, that fact must be found to exist beyond a reasonable doubt by the trier of fact.” People v. Mimes, 2014 IL App (1st) 082747-B, ¶ 26.

¶ 66 Defendant concedes “[t]here are cases holding that the maximum aggregate sentence was based on the maximum extended term for the class of felony” (see People v. Pullen, 192 Ill. 2d 36, 46 (2000); People v. Woods, 131 Ill. App. 3d 51, 55 (1985); People v. Beck, 190 Ill. App. 3d 748, 763 (1989); People v. Myrieckes, 315 Ill. App. 3d 478, 482 (2000)), but he argues that because those cases predated Apprendi and subsequent changes to the Code, the maximum aggregate sentence should not be calculated using the authorized extended-term sentence for Class 2 felonies. However, beyond the mere assertion that the legal landscape is now different, defendant does not explain why the Apprendi decision affects the section 5-8-4(f)(2) calculation. Further, the State points out that Thompson, which defendant cites favorably, calculated the maximum aggregate sentence using the maximum extended-term sentence, even though the sentencing court did not find that the defendant in Thompson was eligible for an extended-term sentence. See Thompson, 2022 IL App (2d) 190950-U, ¶ 35 (citing Myrieckes, 315 Ill. App. 3d at 482).

¶ 67 In People v. Wagener, 196 Ill. 2d 269, 286 (2001), the Illinois Supreme Court rejected a similar argument that the imposition of consecutive sentences pursuant to section 5-8- 4(b) of the Code was unconstitutional because it violated Apprendi. The court concluded as follows:

“We find that Apprendi concerns are not implicated by consecutive sentencing. It is a settled rule in this state that sentences which run consecutively to each other are not transmuted thereby into a single sentence. [Citations.] Because consecutive sentences remain discrete, a determination that sentences are to be

20

served consecutively cannot run afoul of Apprendi, which only addresses sentences for individual crimes. Accordingly, section 5-8-4(b) of the Code passes constitutional muster.” Id.

¶ 68 As in Wagener, the present case does not concern an increase to defendant’s individual sentences. Instead, section 5-8-4(f)(2) is a statutorily imposed limit on the total length of time defendant can serve on his mandatory consecutive sentences. See Pullen, 192 Ill. 2d at 45 (“[T]he aim of section 5-8-4(c)(2) of the Code [(730 ILCS 5-8-4(c)(2) (West 1994))], and statutes like it, is to limit the total length of consecutive sentences imposed on a defendant, while still fairly punishing the defendant in relation to the severity of the crimes.” (Internal quotation marks omitted.)). Because a determination of whether defendant will be subjected to consecutive sentencing does not violate Apprendi, we see no reason why section 5-8-4(f)(2)’s limit on the total length of a defendant’s sentence would operate differently. Accordingly, we calculate the maximum aggregate prison sentence that defendant can serve for a single course of conduct based on the maximum authorized extended-term sentence.

¶ 69 2. Calculating Defendant’s Sentence

¶ 70 We begin by addressing the sentence imposed on count 13. We have upheld the trial court’s implicit finding that defendant’s possession of the material at issue in this charge occurred on or before February 24, 2017, and that it is the result of a course of conduct separate from any of the 14 other charges. Consequently, we affirm the trial court’s sentence of four years’ imprisonment imposed on count 13, to run consecutively to the remaining counts.

¶ 71 We have also concluded, however, that the trial court’s finding of separate courses of conduct is unsustainable when it comes to the charges related to defendant’s possession of the 11 image files as charged in counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102. Because the two

21

most serious felonies involved in this case are Class 2 felonies (possession of child pornography), the maximum aggregate sentence for offenses that were part of a single course of conduct is 28 years in prison—twice the 14-year maximum for an extended-term sentence. See 720 ILCS 5/11- 20.1(c-5) (West 2020); 730 ILCS 5/5-4.5-35(a) (West 2020); Pullen, 192 Ill. 2d at 43 (concluding the maximum aggregate sentence for two Class 2 felonies was 28 years in prison). Consequently, we honor the statutory cap on consecutive sentences. Pursuant to our authority under Illinois Supreme Court Rule 615(b)(4) (eff. Jan 1, 1967), we reduce defendant’s aggregate sentence on these 11 charges to 28 years’ imprisonment. Because the record supports the conclusion that there were years between defendant’s acquisition of the 11 image files and the single video file at issue in count 13, the four-year sentence on the latter runs consecutively to the 28-year aggregate sentence on the former.

¶ 72 Finally, we have determined that the trial court’s finding that the offenses relating to the three video files at issue in counts 6, 8, and 17 constitute separate courses of conduct is against the manifest weight of the evidence. We hesitate, however, to bundle these offenses into the same course of conduct as the 11 image file possession charges—a conclusion that would bring these charges under the existing 28-year cap—because such a conclusion is also not clearly supported by the evidence. We are cognizant of the fact that, with appropriate expert interpretation, the basis for finding that the actions at issue in counts 6, 8, and 17 were separate courses of conduct may already be present within the metadata found in People’s Exhibit 1. In other words, unlike the 11 image possession counts, the metadata leaves the door open to the possibility that the three video files were obtained by defendant on separate dates.

¶ 73 Reviewing courts must exercise cautiously their authority under Rule 615 to reduce a defendant’s sentence. People v. Jones, 168 Ill. 2d 367, 378 (1995). Among the considerations in

22

deciding whether to remand for resentencing is whether the parties may have “new or additional evidence to offer upon remand.” Id. “A remand to the trial court affords the parties the opportunity to present new or additional evidence.” People v. Quevedo, 403 Ill. App. 3d 282, 300 (2010). Here, for example, the parties may wish to offer additional expert testimony concerning the conclusions which can be drawn from the pertinent file metadata with respect to defendant’s original dates of possession.

¶ 74 For this reason, we feel that the appropriate disposition with respect to counts 6, 8, and 17 is to vacate the trial court’s imposition of consecutive sentences on these three counts and remand solely for the purpose of addressing whether the consecutive sentences are subject to the same 28-year cap applicable to the 11 image file counts. This will require the trial court to determine whether any of the 3 video files constituted courses of conduct separate from defendant’s April 1, 2021, possession of the 11 image files; if any are found to be separate courses of conduct, the trial court’s four-year sentence on any such count would be made consecutive to the sentences on the other counts without limitation. If, however, possession of any of these 3 files is found to be the result of the same course of conduct which led to defendant’s possession of the 11 image files, the overall sentence for those counts would be subject to the same 28-year cap applicable to the 11 image files (i.e., defendant would receive no additional years of incarceration on such counts). Defendant’s aggregate sentence will be either 32, 36, 40, or 44 years, depending on whether the trial court finds none, 1, 2, or all 3 of the 3 video files are subject to the same 28- year cap applicable to the 11 image file counts. The trial court should then issue a corrected mittimus accurately reflecting defendant’s aggregate sentence.

¶ 75 III. CONCLUSION

¶ 76 For the reasons stated, we affirm defendant’s four-year sentence on count 13; we

23

modify defendant’s consecutive sentences on counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102 to an aggregate sentence of 28 years’ imprisonment (consecutive to the sentence on count 13); and we vacate the imposition of consecutive sentences on counts 6, 8, and 17 and remand the cause for the trial court to address whether the sentences on any of those 3 counts is subject to the same 28- year cap that applies to the 11 image file counts.

¶ 77 Affirmed in part, modified in part, and vacated in part; cause remanded with directions.

¶ 78 JUSTICE STEIGMANN, specially concurring in part and dissenting in part:

¶ 79 I concur in the majority’s disposition in two respects. First, I agree that the consecutive sentences imposed on the 11 counts based on possession of illicit image files (counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102) are properly capped at a total of 28 years. Second, I agree with the majority that the record supports the trial court’s conclusion that count 13, based on possession of an illicit video file, is not part of the same “single course of conduct” as the previously mentioned 11 counts.

¶ 80 I respectfully disagree, however, with the conclusion of my distinguished colleagues that the record does not support separate course-of-conduct findings for counts 6, 7, and 17. In addition, notwithstanding my disagreement with their conclusion regarding the number of separate courses of conduct supported by the record, I disagree with their decision to remand the case for the presentation of additional evidence as to only counts 6, 7, and 17.

¶ 81 A. The Evidence

¶ 82 I view Wood’s testimony to have adequately apprised the trial court (and this court for that matter) of the significance of the dates in People’s Exhibit 1—specifically, the dates listed in the “Date modified” field (hereinafter modified dates) and “Date created” field (hereinafter

24

created dates). Wood testified that the “created and modified date” for the count 13 video was February 24, 2017, which meant it was “created and modified on [the flash drive] on or before that date.” He then explained what “created” and “modified” meant, in part, by way of the following example:

“So, I will use a picture, for example. If I take a picture, it is going to have a created, modified and last access date. If I crop that image on the same day I created it, I have modified that image, so the stamp will be different. So, if I take a picture of myself, for example, and I put it on my computer, it will have created a modified access. Tomorrow, I go into it and I crop it, the image is still there, but it has been modified. And it was modified the following day. So, the created date that was on the computer was the day I put it on the computer. The date it was modified was the day that I changed any data within that artifact.”

¶ 83 Wood’s testimony means that the modified dates correspond to the last time a file was modified on the flash drive. Regarding the count 13 video file in People’s Exhibit 1, he also testified that the modified date and created date—the date the file came into existence on the flash drive—was February 24, 2017. I note that Wood’s testimony was not that “defendant created and modified the file” on the device on or before that date; instead, he testified, “So the best I can tell you is that item of evidence was created and modified on that device on or before that date.” Accordingly, the trial court had to infer, based on the totality of the evidence and circumstances known to it, whether defendant was the person who modified and created the count 13 file in the flash drive on or before that date. In other words, was that date the earliest known date of possession? The operative inference being as follows: If defendant modified the file on a certain date, then he possessed the file on that date.

25

¶ 84 The record shows that (1) the 15 files were located in defendant’s flash drive, which he admits he had for at least some amount of time prior to April 1, 2021; (2) the files were stored in the flash drive along with hundreds of other files containing child pornography; (3) defendant stated that he had struggled for years with his addiction to child pornography and sought out videos of underage girls; (4) he stated that his addiction culminated in his downloading of “the pictures that [he was] charged with possessing” as a single download, after he stopped receiving photos from L.M.; (5) he stated that when he downloaded the pictures, he “was shocked and disgusted” “[and] promptly exited the file ***. And [he] did not view and go into that folder again”; (6) he stated that he would masturbate to child pornography; and (7) the victim stated that she was groomed by defendant since she was 13 years old.

¶ 85 This evidence supports the inference that the modified dates for the 15 files in People’s Exhibit 1 correspond to the dates defendant gained possession of those files.

¶ 86 Starting with the 11 image files, People’s Exhibit 1 shows that the 11 image files have modified dates of October 22-23, 2019, and were modified over a period of 13 minutes. Those times and dates comport with defendant’s statement in allocution that he downloaded “the pictures that [he was] charged with possessing” as one file after he stopped receiving photos from L.M. Importantly, those 11 image files are the only “pictures” that defendant was charged with possessing and are the only files in People’s Exhibit 1 that show a modified date after defendant’s and L.M.’s correspondence from May 2017 through September 2017 (supra ¶ 16).

¶ 87 The remaining four files in People’s Exhibit 1 are all video files that have modified dates of September 2014, February 2016, February 2017, and August 2017, which again comports with the record. L.M. was born in June 2002, meaning the pornographic photos of her that defendant received from May 2017 through September 2017 were taken when she was 14 and 15

26

years old. She stated that his “grooming” of her began when she was 13 years old, almost two years earlier than when those photos were taken. Clearly, defendant’s sexual interest in underage girls began years earlier than 2017, based on his predation of L.M. alone.

¶ 88 Accepting as true defendant’s claim that he did not again open the folder on the flash drive that contained the 11 photos after downloading them, his statements that he sought out videos of child pornography, masturbated to child pornography, and struggled for years with the addiction line up with the modified dates in People’s Exhibit 1, which range from 2014 to 2019. Those files happen to be video files, which defendant said he had sought out. Also, considering the volume of pornographic material in the flash drive and defendant’s tacit admission that he possessed the files for some time prior to April 1, 2021, the trial court—at the very least—could reasonably infer that the five different modified dates in People’s Exhibit 1 show five separate courses of conduct.

¶ 89 Accordingly, I would affirm the trial court’s order and modify the sentence to reflect those five separate courses of conduct. This would mean that defendant’s sentence would become 44 years in prison, as I explain in my conclusion (infra ¶ 97).

¶ 90 B. Remand

¶ 91 In addition, because I agree with the majority that “it is fair to treat the default date of possession as being April 1, 2021, absent competent evidence of a different date” (supra ¶ 59), I believe that this case should not be remanded for additional evidence on only counts 6, 7, and 17. In keeping with the majority’s conclusions about the evidentiary value of the metadata, on remand, we should also permit additional evidence pertaining to the 11 counts based on possession of illicit image files.

¶ 92 If, as the majority appears to indicate, the only reasonable conclusion about the

27

evidence to draw from Wood’s testimony is that the count 13 video file was downloaded at an earlier date than the remaining 14 files, then those 14 files should be treated similarly to one another. In other words, because the modified dates in People’s Exhibit 1 do not matter, there is no basis for this court to conclude that possession of those 14 files was not part of the same “default” course of conduct on April 1, 2021.

¶ 93 The majority concludes, “As [Wood’s testimony] involved conclusions drawn from two fields of metadata, Wood’s methodology was not susceptible to being extrapolated by the trial court, which had just one. There is, then, no basis on which to find that these 11 files were obtained by defendant via separate courses of conduct on any date other than April 1, 2021.” (Emphasis omitted.) Supra ¶ 55.

¶ 94 Despite that conclusion, the majority appears to extrapolate from Wood’s testimony and the metadata a holding that the 11 image files are part of a single course of conduct. The majority then, without explanation, singles out the counts 6, 8, and 17 video files as potentially being part of separate courses of conduct. This distinction seems wholly at odds with the logic of their decision.

¶ 95 The only reason I see for the distinction is that the majority presupposes that additional evidence on those counts would confirm what the modified dates in People’s Exhibit 1 shows: The images were downloaded as a single course of conduct because they were downloaded over a 13-minute period of time (supra ¶ 57). See Thompson, 2022 IL App (2d) 190950-U, ¶ 42. However, the reasoning in the majority’s disposition is contrary to that presupposition. If taken as true that the trial court or this court is unable to discern the meaning of the metadata from Wood’s testimony (a point with which I strongly disagree), then the metadata for all the remaining 14

28

counts should be of no consequence to this court’s decision.

¶ 96 C. Conclusion

¶ 97 The foregoing analysis leads me to the following conclusions about defendant’s appropriate sentence. First, with respect to the 11 charges related to possession of illicit images (counts 18, 27, 48, 53, 60, 67, 68, 74, 85, 94, and 102), I concur with the majority that defendant’s consecutive sentences for these offenses are capped at 28 years. Second, Wood’s testimony, defendant’s testimony, People’s Exhibit 1, and the circumstances of defendant’s possession provide a basis for the trial court to have concluded that the charges reflected in counts 6, 7, 13, and 17 were part of separate courses of conduct from one another and the 11 image-possession offenses. Accordingly, I would modify defendant’s aggregate sentence to 44 years in prison to reflect the offenses’ having been committed as five separate courses of conduct—4 years in prison each for counts 6, 7, 13, and 17, to be served consecutively to the 28-year maximum aggregate sentence for the remaining 11 counts.