[kobeya]

How does that happen? Technically I mean? This isn't full disk encryption? What terrible software leaked the hashes of what it was encrypting? This seems highly relevant to the discussion.

[DanBC]

It doesn't happen like that.

They know he downloaded files which have the same hash values as known images of child sexual abuse.

They arrest him and search him. They can't find these images but they find an encrypted hard drive.

In some countries (England) they can ask for the keys, and not handing over the keys is its own offence (with 2 or 5 year sentence depending on the supposed contents).

I have no idea what the legal situation is in any other countries.

[kobeya]

The US has a provision on the bill of rights of its constitution saying, loosely, that you can never be compelled / coerced into being a witness against yourself. E.g. "Admit you did this crime or we send you to jail for life." Keep in mind that the bill of rights was written by rebelling colonials who were explicitly countering what they saw as abuses in the English system of law--in your example the ability of a judge to charge you with essentially the "crime" of not helping the prosecution's case. The crux of this case is over whether revealing a password to unlock a drive is the same as admitting to guilt -- which the court cannot compel you to do. There are arguments for both sides, honestly.

[fnordsensei]

It's a misunderstanding. The hashes are of files he's believed to have downloaded, and they want the disks unlocked to see if they're there.

[kobeya]

I see. I think this is my understanding of where the hashes come in -- law enforcement doesn't keep child porn around for comparison. That would be asking for abuse. They instead keep a list of cryptographic hashes of identified child porn files, and they want to see if this hard drive, once decrypted, has any files that match those hashes.

Seems easily defeated by a technical adversary, but probably good enough for most police work.