People v. Zhani

2022 IL App (1st) 200307-U No. 1-20-0307 June 21, 2022 Second Division NOTICE: This order was filed under Supreme Court Rule 23 and is not precedent except in the limited circumstances allowed under Rule 23(e)(1). ______________________________________________________________________________ IN THE APPELLATE COURT OF ILLINOIS FIRST DISTRICT ______________________________________________________________________________ THE PEOPLE OF THE STATE OF ILLINOIS, ) Appeal from the ) Circuit Court of Plaintiff-Appellee, ) Cook County. ) v. ) No. 17 CR 9567 ) WASSIM ZHANI, ) Honorable ) Ursula Walowski, Defendant-Appellant. ) Judge Presiding. JUSTICE HOWSE delivered the judgment of the court. Presiding Justice Fitzgerald Smith and Justice Cobbs concurred in the judgment. ORDER ¶ 1 Held: Defendant’s conviction for theft by threat is affirmed where the evidence presented at trial was sufficient to prove him guilty beyond a reasonable doubt. ¶ 2 Following a bench trial, defendant Wassim Zhani was found guilty of theft by threat (720 ILCS 5/16-1(a)(3)(A) (West 2014)). The trial court imposed a sentenced of 18 months of felony probation and ordered defendant to pay $2000 in restitution. On appeal, defendant challenges the sufficiency of the evidence to sustain his conviction, arguing that the State failed to prove beyond a reasonable doubt that he acted knowingly. For the reasons explained below, we affirm. ¶ 3 Defendant’s conviction arose from the events of September 18, 2015. Following his arrest, defendant was charged by indictment with one count of theft by threat, based on an allegation that he had knowingly obtained, by threat, from Transcontinental Fund Administration, Ltd. (TFA), an amount of money between $500 and $10,000, intending to deprive TFA permanently of the use or benefit of the property. ¶ 4 At trial, Claudia Woerheide testified that she and her husband, Alak Chakravorty, owned TFA, a company that provides fund administration for alternative investment funds. In 2015, TFA had about 12 employees, including accountants who would deal with clients’ confidential bank and portfolio information. At that time, Woerheide was the chief executive officer, and her responsibilities included seeking and hiring employees. ¶ 5 In August 2015, Woerheide posted an opening for an accountant position on Craigslist. One of the applications she received as a result of the post was from defendant, whom she interviewed and then hired, with a salary of $40,000 per year and a pay schedule of once per month. The email address that defendant provided on TFA’s new employee form was wzhani@sycamores.indstate.edu. When defendant started employment on August 27, 2015, his job duties were to perform accounting and value calculation for particular funds that were assigned to him. He was not allowed to take files home or back up files on a personal server. ¶ 6 After defendant had been working for TFA for about one and a half weeks, Woerheide got the impression that his employment “was not as smooth as [she] would have imagined it should be.” Woerheide and defendant had a conversation regarding his work performance during which -2he expressed concern about the status of his job, and she told him they were not looking to replace him. During the conversation, they discussed, among other things, a listing that she had posted on Craigslist for an accountant, which defendant had seen. According to Woerheide, TFA was looking to hire an additional accountant to enlarge the business. A day or two later, defendant asked Woerheide for a letter stating he would be permanently employed by TFA, as he was moving and needed employment verification for his landlord. She told him that she would write a letter, but, because he was an employee at will, she would not use the word “permanently.” On or about September 15, 2015, Woerheide provided defendant an employment verification letter. ¶ 7 On September 17, 2015, Woerheide was notified by Craigslist that someone was attempting to change her post for an accountant so that résumés would be sent to a different email address. She explained, “And it was supposed to be changed to an address that resembled the name of Wassim Zhani but it was not his normal e-mail address that I was aware of.” The new email address was zaheminem@hotmail.com. ¶ 8 When Woerheide arrived at the office the next day, September 18, 2015, it was in an “uproar” and employees were upset. She spoke with two employees in her office and then with defendant in a common area. Woerheide asked defendant if he had tried to change the email address on Craigslist, and he replied by asking, “[W]hat is Craigslist[?]” Woerheide told him it was the platform through which he had applied for the job with TFA. She also asked him “what he was doing with the files on the computer of funds that he was not supposed to deal with.” Defendant became upset and said that he had had enough of his job and was giving it up “right now.” Woerheide told him he could not work at TFA any longer because his behavior was unacceptable. Defendant left the office about 11 a.m. -3- ¶ 9 Around noon, Woerheide started receiving a series of three emails with multiple attachments of files that belonged to TFA and its clients. The emails indicated that “soon TFA files will all be public” and that “confidential information was going to be disclosed to people who were not supposed to see that information.” The emails were from “Lio Bao,” with an address of “liobao123@gmail.com,” and were addressed to TFA clients and the clients’ funds managers, employees, and outside service providers. The attached files consisted of proprietary information that TFA had made for its clients and that were the type and nature of files to which someone in the accounting operations unit would be able to access. ¶ 10 About 12:50 p.m., Woerheide received a phone call. She recognized the caller’s voice as defendant’s. He told Woerheide that he wanted money that he thought was due to him. Throughout the afternoon, Woerheide and defendant spoke on the phone several times. At some point, Woerheide asked him whether he was Lio Bao and told him that as long as she was getting emails from Lio Bao, he would “not get a cent from TFA.” Defendant denied that he was Lio Bao and said, “[D]on’t worry about the Chinese hacker. If I get the money, the e-mail will go away.” When Woerheide asked how he could make such a promise if he was not Lio Bao, defendant stated, “I have control over him.” Defendant asked for $20,000 “[o]r the e-mails would continue.” Woerheide notified the police. ¶ 11 Over the course of several phone calls, Woerheide negotiated with defendant. Eventually, she generated a proposal, which she emailed to him at the address he had provided when he applied for the job. In the email, which was sent at about 4:30 p.m., Woerheide suggested that TFA could pay defendant on a monthly basis for the next six months and that he would receive “the equivalent of your former salary.” In exchange, defendant would destroy the information he took from TFA’s -4server and not distribute it. In court, Woerheide explained that she suggested the six-month timeframe “[b]ecause it is very hard for us to pay $20,000 at once. And also we have informed the police in between and the FBI and were hoping that somebody would help us stop it.” ¶ 12 After Woerheide sent the email, she had another phone conversation with defendant, during which he insisted he needed $5000 right away. He also wanted to have the remainder of the money distributed over the next three months, as opposed to six. Woerheide agreed and prepared a check written out to defendant from a TFA account for $5000, which she left at the office building’s security desk for defendant to pick up. In the memo line on the check, Woerheide wrote, “as per our proposal.” According to Woerheide, defendant picked up the check around 5:30 p.m. About half an hour or an hour later, he called Woerheide and told her he needed the remaining $15,000, which was “due now as well.” ¶ 13 Around 7 p.m., defendant appeared outside TFA’s locked office doors, followed by a building security guard. He demanded that he be paid $15,000 that day. Sometime before midnight, Woerheide checked the TFA bank account online and saw that $5000 had been withdrawn. ¶ 14 Woerheide testified that defendant was an at-will employee of TFA. He was never given an employment contract. She and defendant never had an agreement regarding any sort of severance package, and TFA never provided severance packages for at-will employees who worked at TFA for only a couple of weeks. TFA did not give bonuses to its employees. When asked why she gave defendant $5000, she answered, “Because he threatened us.” She explained that defendant threatened the survival of TFA with the potential public release of clients’ confidential data. Woerheide also testified that as a result of the emails, TFA lost clients, which was a “huge financial loss” to the company. -5- ¶ 15 On cross-examination, Woerheide reiterated that during a conversation with defendant, he said if TFA paid him, he would be able to stop the “Chinese hacker.” When asked whether she knew when the files at issue were downloaded, she answered that she had been told it occurred over several days, starting a day or two before September 18, 2015, “which was one of the reasons why the other employees in my office noticed that something was happening that was not correct because [defendant] was working on files that he was not supposed to work on.” She did not personally observe defendant doing such work. She explained that each computer at the office was only accessible to the person assigned to it, as employees had to log in with user names and passwords. After the incident, TFA hired a company to conduct forensic research into the downloaded files and prepare a report. Woerheide did not recall the exact date provided in the report for when the files were downloaded, but did remember that the downloading began “way before” September 18, 2015. She also recalled that some files “suddenly became missing” and were deleted from the server on that date. ¶ 16 On further cross-examination, Woerheide testified that at the time of the incident, TFA employed Candace Dent as her personal assistant. Dent performed office management tasks, including billing and payments. Sometime after September 2015, some checks were stolen from TFA checking ledgers. Woerheide eventually discovered that Dent was “dealing with the checks improperly,” and informed the police. According to Woerheide, Dent was prosecuted. ¶ 17 Alak Chakravorty testified that in 2015, he was the Chief Operating Officer of TFA and was involved in the hiring process for the company, including the hiring of accountants. TFA employed about five accountants, who managed and administered about 30 clients and 40 to 45 -6funds. The primary duty of accountants was to calculate net asset values and maintain accounting books, and each accountant would be responsible for 15 to 20 clients. ¶ 18 Chakravorty testified that each employee was given a unique user name and password to access his or her work computer. Depending on their roles, accountants were also given access to certain locations on the server. An accountant who was not assigned to a certain client could have access to some of the client’s files, but would not have access to the client’s “books.” Employees were not authorized to share clients’ confidential information with other employees who were not assigned to those clients. According to Chakravorty, TFA hired defendant as a junior accountant in August 2015. ¶ 19 On September 18, 2015, Chakravorty arrived at TFA’s office mid-day and found it “in an uproar.” He learned that Woerheide had fired defendant that morning. He then logged in on his computer and began looking at emails, at which point he discovered he had received an email from liobau123@gmail.com. The subject line of the email indicated TFA files would be made public, and attachments to the email included a number of clients’ files that were confidential. Chakravorty received two more emails from the same address with client files attached. He also received a phone call from a client who had been copied on the emails and whose files were attached. ¶ 20 Around 12:45 or 12:50 p.m., Woerheide received a call on her cell phone, which Chakravorty picked up. He recognized the caller’s voice as defendant’s. Chakravorty asked defendant whether he knew anything about the emails. Defendant did not admit to sending the emails, but told Chakravorty that the “problem” would stop if TFA paid him compensation of $20,000. Chakravorty understood the “problem” to be the threatening emails. He told defendant he needed to talk with Woerheide and they would call him back. According to Chakravorty, -7because defendant had only worked at TFA for about three weeks, he was owed his salary for that time but not any other compensation. ¶ 21 Chakravorty participated in several other phone conversations with defendant that afternoon, some on speaker. During those calls, defendant demanded that $5000 be paid to him that day, and $15,000 be paid to him over the course of three months. At one point, on speaker, Woerheide asked defendant about the “Chinese hacker,” and defendant indicated there was no “Chinese hacker” and the “Chinese hacker problem” would go away if he was paid. ¶ 22 A check for $5000 was made out to defendant from the company account and left at the office building’s security desk for defendant to pick up. The check was cashed later that night. Chakravorty and Woerheide planned with the FBI to have defendant come to the TFA office. However, defendant came up the elevator earlier than he was supposed to have arrived at the office. Chakravorty met defendant at the door and told him the check for the remaining amount was not ready and he should come back at 9 p.m. Defendant agreed. ¶ 23 Chakravorty authorized the FBI to provide him with a body recorder and transmitter to record his conversation with defendant when he returned to pick up a second check. When defendant arrived around 9:30 p.m., Chakravorty and Woerheide were by the computers in the open area of the office, and FBI agents were in the office but out of sight. Chakravorty and defendant then engaged in a conversation, the recording of which was introduced into evidence. ¶ 24 During the conversation, defendant related that he wanted compensation because he did not know how long he would be unemployed and because he incurred costs, particularly by buying suits, while working at TFA. Defendant denied sending any emails to accounts outside the office and told Chakravorty he would not have to worry “about anything” after he left. After Chakravorty -8gave defendant a password to access a TFA computer, defendant showed Chakravorty 14 gigabytes of files. Chakravorty asked, “So this is a OneDrive account that you put it onto?” Defendant answered, “This is everything,” and indicated that he was going to delete it all. At the end of the recording, FBI agents identified themselves and arrested defendant. ¶ 25 In court, Chakravorty explained that in the normal course of TFA’s business, client files would not be saved in a OneDrive account. He further stated that there was no legitimate reason for the files that defendant deleted from his personal OneDrive account to have been stored there. He never gave defendant permission to transfer client files from the company server to OneDrive. ¶ 26 On cross-examination, Chakravorty confirmed that Candace Dent had been an employee of TFA, but denied that she had access to “work stations” in the company. He was aware that Dent was involved in some fraud at TFA. Neither he nor anyone at TFA ever inquired as to whether Dent was involved in the emails, as “she would not have had access or known about any of those files because that was not her department.” ¶ 27 FBI Special Agent Christopher Weismentel testified that in 2015, he was working in cyber intrusion and cyber-enabled fraud in the Chicagoland area and was assigned to the TFA investigation on September 21, 2015. In the course of his investigation, he reviewed bank records for a BMO Harris checking account for TFA and a JP Morgan Chase bank account for New Sterling Factory, a partnership with partners listed as defendant and Wang Ming Guan. Defendant and Wang Ming Guan were the signers on the JP Morgan Chase account. ¶ 28 Included in the bank records was a copy of a check from the TFA account, dated September 18, 2015. The check was payable for $5000 to defendant, signed by Woerheide, and indicated “as per our proposal” in the memo line. The JP Morgan Chase records included a deposit slip from -9September 18, 2015, and a copy of the same check. Weismentel noted that defendant’s signature on the JP Morgan Chase account was similar to the signature for endorsement of the check from TFA. He also noted that defendant’s name was provided on the deposit slip. Weismentel determined that the funds moved from TFA’s checking account to the joint bank account defendant held with Wang Ming Guan, and that the check was deposited the same day it was issued. ¶ 29 On cross-examination, Weismentel stated that he did not know who Candace Dent was, but that her name “came up related to one of the other fraudulent activities” Woerheide told him had occurred around the time defendant was fired. He did not interview Dent. He also did not have an opportunity to determine when any TFA files were uploaded to a OneDrive account. ¶ 30 The parties stipulated that, if called as a witness, James Day would testify that on September 18, 2015, he was working security for the building where TFA had its office. Around 4:15 or 4:30 p.m., he was provided an envelope with instructions to give it to defendant, who was not given access to the building. Around 5:30 or 6:00 p.m., Day gave defendant the envelope and informed him he was not allowed inside the building. Defendant left with the envelope. Later that evening, defendant returned, “was able to get past Day,” and entered an elevator. Day took a separate elevator to the floor where TFA had its office. There, he saw defendant speaking to a man and woman, who told defendant to return at 9 p.m. Day then escorted defendant out of the building. ¶ 31 The parties stipulated that, if called as a witness, Wang Ming Guan would testify that defendant was her husband and that she “is on the account” from JP Morgan Chase bank titled “New Sterling Factories,” which was a business that was going to be set up to sell jewelry. She never signed or deposited the $5000 check in question, and the signature on the deposit slip was not hers. She would have further testified that she never made or transmitted any threats to TFA. - 10 - ¶ 32 Defendant made a motion for a directed finding, which the trial court denied. ¶ 33 Defendant testified that he started working at TFA as an accountant on August 27, 2015, and was trained by a senior accountant. Defendant experienced some “conflict” with other employees about job responsibilities involving a particular client that was not going to renew its contract with TFA. When he arrived at work on the morning of September 18, 2015, a coworker mentioned to him that “some files got deleted.” Three coworkers then told him to shut down his workstation. Defendant continued working. ¶ 34 When Woerheide arrived, defendant’s coworkers went into her office and talked to her. Later, Woerheide approached defendant and told him “some files were deleted.” Defendant did not know anything about the deleted files and told Woerheide so. Woerheide then told him he was fired. Defendant replied that he left another job to work at TFA, so she would have to give him a severance package. Woerheide responded that if he wanted a severance package, he would have to go look for an employment lawyer. ¶ 35 After defendant went home, he called Woerheide and told her he wanted a severance package because he relocated for the job, had to buy new suits, and trained himself in QuickBooks. Woerheide mentioned “something about the files,” but he did not pay attention. Later, Woerheide called and told him he could come to the office to pick up his severance pay. According to defendant, “[w]e were discussing severance package about $20,000,” but when he picked up his check, it was for only $5000. He deposited it into the joint checking account he shared with his wife. ¶ 36 Defendant denied that he ever made any threats in order to secure the money he received. He also denied sending any emails containing confidential TFA information. He explained that in - 11 - the FBI recording, he was talking about files on his desktop at his work station, not files “in OneDrive or anything like that.” ¶ 37 Following closing arguments, the trial court found defendant guilty of theft by threat. In announcing its decision, the court stated it found that defendant may have felt that he deserved some kind of compensation, but “the way he went about it was illegal, the way he went about it was a threat.” The court found that TFA paid defendant $5000 because he had threatened Woerheide and Chakravorty, and noted that it found Woerheide and Chakravorty to be credible. In contrast, the court noted that nothing corroborated defendant’s position that the $5000 he received was severance, and stated, “I don’t find that his denial as to the threats were [sic] credible at all.” ¶ 38 Defendant filed a posttrial motion arguing, among other things, that the evidence was insufficient to prove him guilty beyond a reasonable doubt. The trial court denied the motion. In doing so, the court explained that it found Woerheide and Chakravorty credible and that there was a lack of corroboration for defendant’s testimony that TFA paid him money because they owed him. ¶ 39 The trial court sentenced defendant to 18 months of felony probation and ordered him to pay $2000 in restitution. Defendant filed a timely notice of appeal. ¶ 40 On appeal, defendant challenges the sufficiency of the evidence to sustain his conviction, arguing that the State failed to prove beyond a reasonable doubt that he had the required mental state for theft by threat. ¶ 41 When reviewing the sufficiency of the evidence, the relevant inquiry is whether, after viewing the evidence in the light most favorable to the prosecution, any rational trier of fact could - 12 - have found the essential elements of the crime beyond a reasonable doubt. Jackson v. Virginia, 443 U.S. 307, 318-19 (1979). This standard of review applies regardless of whether evidence is direct or circumstantial, and circumstantial evidence meeting this standard is sufficient to sustain a criminal conviction. People v. Jackson, 232 Ill. 2d 246, 281 (2009). All reasonable inferences from the evidence must be drawn in favor of the State. People v. Hardman, 2017 IL 121453, ¶ 37 . The credibility of the witnesses, the weight to be given their testimony, and the resolution of any conflicts in the evidence are within the province of the trier of fact, and a reviewing court will not substitute its judgment for that of the trier of fact on these matters. People v. Brooks, 187 Ill. 2d 91, 131 (1999). Reversal is justified only where the evidence is “so unsatisfactory, improbable or implausible” that it raises a reasonable doubt as to the defendant’s guilt. People v. Slim, 127 Ill. 2d 302, 307 (1989). ¶ 42 In this case, defendant was convicted of theft by threat. 720 ILCS 5/16-1(a)(3)(A) (West 2014). A person commits theft by threat when he or she knowingly obtains by threat control over property of the owner, and intends to deprive the owner permanently of the use or benefit of the property. Id. The prescribed mental state of knowledge applies to each element of the offense. See 720 ILCS 5/4-3(b) (West 2014). Knowledge is defined by statute as follows: “A person knows, or acts knowingly or with knowledge of: (a) The nature or attendant circumstances of his or her conduct, described by the statute defining the offense, when he or she is consciously aware that his or her conduct is of that nature or that those circumstances exist. Knowledge of a material fact includes awareness of the substantial probability that the fact exists. - 13 - (b) The result of his or her conduct, described by the statute defining the offense, when he or she is consciously aware that that result is practically certain to be caused by his conduct.” 720 ILCS 5/4-5(a), (b) (West 2014). ¶ 43 The mental state of “knowingness” may be proven by circumstantial evidence and inferred from a defendant’s actions and the conduct surrounding them. People v. Jackson, 2017 IL App (1st) 142879 , ¶ 24. Inferences regarding a defendant’s mental state are matters particularly within the province of the trier of fact. People v. Lemke, 384 Ill. App. 3d 437, 445-46 (2008). As such, we will not substitute our judgment for that of the trier of fact regarding a defendant’s mental state unless the inferences accepted by the trier of fact were inherently impossible or unreasonable. People v. Price, 225 Ill. App. 3d 1032, 1035 (1992). ¶ 44 Defendant argues that the State failed to prove beyond a reasonable doubt that he had the required mental state for the element “by threat.” In this court, defendant does not dispute that the emails sent to Woerheide and Chakravorty constituted threats for purposes of his theft by threat conviction. Rather, he maintains that the State did not prove either that he was the source of the threats emailed to Woerheide and Chakravorty, or that he directed someone else to send the emails. Noting that “other employee fraud” was occurring at TFA around the time of the incident, defendant suggests that Woerheide may have misattributed the emailed threats to him when he was asking for severance. He also suggests that he only knew about the emails because Woerheide had asked him about them. Defendant reasons that absent proof he made the threats contained in the emails, the State failed to show that he knowingly obtained money from TFA “by threat,” and, therefore, his conviction must be reversed. - 14 - ¶ 45 After reviewing the evidence in the light most favorable to the prosecution, we find that it supports the trial court’s determination that defendant knowingly obtained the $5000 at issue by threat. Woerheide testified that during one of her phone conversations with defendant, she asked him whether he was Lio Bao and told him that as long as she was getting emails from Lio Bao, he would “not get a cent from TFA.” In response, defendant denied that he was Lio Bao, but told Woerheide that if he got the money he was asking for, the emails would go away, as he had “control over” Lio Bao. Woerheide also testified that defendant asked for $20,000 “[o]r the e-mails would continue.” On cross-examination, she reiterated that during a conversation with defendant, he said if TFA paid him, he would be able to stop the “Chinese hacker.” When asked in court why TFA gave defendant $5000, Woerheide answered, “Because he threatened us.” ¶ 46 Consistent with Woerheide, Chakravorty testified that during one of his own phone conversations with defendant, he asked defendant about the emails and defendant responded that the “problem” would stop if TFA paid him compensation of $20,000. Chakravorty also listened in on a phone conversation between Woerheide and defendant on speaker, during which defendant indicated that the “Chinese hacker problem” would go away if he was paid. ¶ 47 Although the State did not present evidence that defendant personally sent the damaging emails to TFA and its clients or explicitly directed someone else to send them, such a showing was not necessary. The State was required to prove that defendant knowingly obtained the $5000 in question by threat. Both Woerheide and Chakravorty testified as to threats defendant made to them over the phone, indicating that the cessation of the emails was contingent on them paying him, which they did. Based on this evidence, a rational fact-finder could conclude that defendant was consciously aware that his conduct was of a threatening nature. See 720 ILCS 5/4-5(a), (b) (West - 15 - 2014). Thus, the evidence was sufficient to prove the requisite mental state of knowingness. See Jackson, 2017 IL App (1st) 142879, ¶ 24 . ¶ 48 In reaching this conclusion, we are mindful that defendant presented a different version of events at trial. However, the trial court was not obligated to accept his testimony as true. The trial court specifically found Woerheide and Chakravorty to be credible, and defendant’s denial of the threats to be incredible. This was the court’s prerogative in its role as the trier of fact (People v. Moody, 2016 IL App (1st) 130071 , ¶ 52) and we will not substitute our judgment for that of the trial court on questions of credibility (Brooks, 187 Ill. 2d at 131 ). ¶ 49 Moreover, in reaching its decision the trier of fact was “not required to disregard inferences which flow normally from the evidence and to search out all possible explanations consistent with innocence and raise them to a level of reasonable doubt.” People v. Hall, 194 Ill. 2d 305, 332 (2000). In turn, this court will not search out possible theories of acquittal and prefer them over the findings of the trial court. People v. Lee, 2015 IL App (1st) 132059, ¶ 63 . Viewing the evidence in the light most favorable to the prosecution, which we must, we find that a rational trier of fact could have found defendant guilty of theft by threat beyond a reasonable doubt. The evidence is not “so unsatisfactory, improbable or implausible” that it raises a reasonable doubt as to defendant’s guilt. Slim, 127 Ill. 2d at 307 . Defendant’s challenge to the sufficiency of the evidence fails. ¶ 50 For the reasons explained above, we affirm the judgment of the circuit court. ¶ 51 Affirmed. - 16 -