If you follow 3D printing at all, and even if you don't, you've likely seen some of the recent controversy surrounding Defense Distributed and its 3D-printed firearm designs. If you haven't, here's a brief summary: Defense Distributed has created 3D firearm models and initially published them for free on its DEFCAD website a number of years ago. Some of those 3D models were designed to be printed with a traditional home hobbyist 3D printer (at least in theory), and other designs were for Defense Distributed's "Ghost Gunner"—a computer-controlled CNC mill aimed at milling firearm parts out of metal stock. The controversy that ensued was tied up in the general public debate about firearms, but in particular, a few models got the most attention: a model of an AR-15 lower receiver (the part of the rifle that carries the serial number) and "the Liberator", which was a fully 3D-printed handgun designed to fire a single bullet. The end result was that the DEFCAD site was forced to go offline (but as with all website take-downs, it was mirrored a million times first), and Defense Distributed has since been fighting the order in court.
The political issues raised in this debate are complicated, controversial and have very little to do with Linux outside the "information wants to be free" ethos in the community, so I leave those debates for the many other articles on this issue that already have been published. Instead, in this article, I want to use my background as a hobbyist 3D printer and combine it with my background in security to build a basic risk assessment that cuts through a lot of the hype and political arguments on all sides. I want to consider the real, practical risks with the 3D models and the current Ghost Gunner CNC mill that Defense Distributed provides today. I focus my risk assessment on three main items: the 3D-printed AR-15 lower receiver, the Liberator 3D-printed handgun and the Ghost Gunner CNC mill.
This 3D model was one of the first items Defense Distributed shared on DEFCAD. In case you aren't familiar with the AR-15, its modular design is one of the reasons for its popularity. Essentially every major part of the rifle has numerous choices available that are designed to integrate with the rest of the rifle, and you can find almost all of the parts you need to assemble this rifle online, order them independently, and then build your own—that is, except for the lower receiver. That part of the rifle is what the federal government considers "the rifle", as it is the part that's stamped with the serial number that uniquely identifies and registers one particular rifle versus all of the others out there in the world. This part has restrictions like you would find with a regular rifle, revolver or other firearm.
The fact that the lower receiver gets the serial number is what makes a 3D-printed lower receiver so controversial, because if you can print your own, you can attach it to all of the other rifle parts you purchased online and assemble a rifle that has no serial number. The concern is that people will buy a 3D printer and create an AR-15 rifle that can't be traced.
If you haven't done much 3D printing, you may not know that just because a 3D model for a part exists, it doesn't mean you can print it. Most of the designs offered by sites like Thingiverse were created by 3D modelers who understand the limitations of home 3D printers (like needing to print support material if you print part of an item over the open air), and they design their parts accordingly. The AR-15 lower receiver never was designed to be printed on a 3D printer, and it turns out that this model is a particularly difficult one to print due to the various overhangs and other complex parts of the model. A number of tech articles have been published in which the authors attempt to describe how to print out the lower receiver, and the end result tends to be that it's technically possible to do so on a home 3D printer if it has high enough tolerances, but that even after you deal with removing all of the support material, you still have to spend quite a bit of time cleaning up the part just to make it fit, much less work well, in a real AR-15.
If you look online, you'll also find some video tests of this lower receiver showing that if you do get things to fit and file down the part properly, eventually you may get a receiver that can handle at least a few hundred rounds before it breaks. Note that this is with a well-calibrated and high-quality 3D printer with high-quality plastic. Someone who isn't well versed in the hobby likely will create a part with poor layer adhesion, poor tolerances and poor-quality plastic that won't be nearly as durable.
So what's the risk with this part? The risk is that after investing hundreds of dollars in a 3D printer, many hours of effort in printing and cleaning up the part, and decent expertise into AR-15 design in order to assemble the rifle from scratch, someone could create an AR-15 rifle without a serial number. Alternatively, for less than $50, someone could buy a brand-new, lower receiver made out of metal, and instead of using a cheap metal file to painstakingly shape a plastic lower receiver into the right shape, one could just quickly file away the serial number on the metal part.
In the end, any reasonable criminals who wanted to build an untraceable AR-15 wouldn't go to all of the trouble to 3D-print one. Instead, they would just buy a new or used, off-the-shelf, cheap lower receiver (either legally or illegally) and remove the serial number. It's much cheaper, faster and simpler, and it results in a much stronger part, so the threat from a 3D-printed lower receiver in my mind is pretty minimal.
The next controversial part from Defense Distributed that made the news was "The Liberator", which is the first fully 3D-printed handgun. Unlike with the AR-15 lower receiver, the controversy around this firearm was less the concern that it was untraceable, but more the concern that because it was almost 100% plastic (the firing pin is a nail from a hardware store, and Defense Distributed accounted for adding a sheet of metal inside the plastic to comply with legislation prohibiting firearms that defeat a metal detector), in theory, someone could print one of those firearms and get it past a metal detector.
There's a few things to know about the Liberator. First, the firearm can fire only a single round. Second, there are examples online of people who have printed out a Liberator successfully and tested it. The results were that it did indeed fire, although in some cases, the firearm itself exploded instead. Printing durable parts with a hobbyist 3D printer requires a certain level of 3D-printing expertise, quality plastic and a well-calibrated printer.
When you fire a gun, you essentially create an explosion inside the firearm. The firearm is designed to contain that explosion without breaking, and because the firearm doesn't break apart, all of that explosive force propels the bullet through the barrel and out of the gun. When you create a 3D-printed part, you are creating it out of layers of melted plastic. If you calibrate your temperatures and printer well, each layer should melt into the previous layer and stick together. Where those layers join is still a potential weak spot, however, and it just takes a slightly cooler print head to result in bad layer adhesion and a weak part.
So, is the Liberator a practical risk? The typical concern seems to be about some kind of terrorist who is able to smuggle an untraceable gun past security and onto a plane or inside a secured building. Practically speaking, do you think any reasonable attackers would want to be limited to a single shot, or are they going to carry a duffel bag full of these things? Otherwise, what real damage could an attacker do with just a single round? With air marshals frequently flying undercover on planes, would an attacker risk hijacking a plane with a single shot knowing someone might be onboard with a real firearm? The same risk goes for any secured building. Of course, I'm not even factoring in the fact that such a handgun isn't going to be very accurate, and that there's a reasonable chance it will blow up in the attacker's hand instead of firing. Any criminal who would want to use a firearm for a terrorist act would not choose such a risky, flimsy, single-shot device.
The final item to consider is the Ghost Gunner CNC mill. This is a full-featured computer-controlled mill that can take a block of metal, accept an uploaded design and then mill out a perfect metal part. The current Ghost Gunner 2 mill costs around $2,000, but it requires purchasers to get their own jig sets and, of course, set up the mill itself. Once that's done, they can send designs for an AR-15 lower receiver as well as a frame for a 1911 pistol and mill them out of metal stock. After a bit of clean up, they have a perfect and strong part suitable for replacing any part they otherwise could purchase from a gun dealer.
Like with the 3D-printed AR-15 lower receiver, the controversy with the Ghost Gunner mill is that you can use it to create a part without a serial number. Of course, gunsmiths have long been allowed to make their own rifles and pistols at home legally without serial numbers for personal use, so that part is nothing new. The main controversy here is the fact that you don't need the same level of machinist skills with a Ghost Gunner, because the computer takes care of all of the precision cuts you'd otherwise have to do yourself with a traditional mill. Also unlike the 3D-printed part, this is a real, strong metal part with high tolerances that doesn't require a lot of fine adjustments after it's made.
So let's discuss the practical risk with the Ghost Gunner mill. The first concern presumably is that anyone could purchase a mill and then create an untraceable rifle or handgun. Like with the 3D-printed part, however, do you think a criminal who wanted one or two untraceable guns would go to the trouble of buying a $2,000 machine, buy all of the jigs, set it up, source metal stock and then print the part, when they could buy a new lower receiver for $50 and remove the serial number? I guess after around the 50th lower receiver they would break even on the Ghost Gunner, jigs and metal stock.
The next concern, then, isn't over someone creating a single untraceable firearm but instead mass-producing them. I imagine someone who wants to create an illegal, under-the-radar firearm business could use a Ghost Gunner to do that, but then again, they also could just hire a gunsmith (or learn how to do it themselves) and do it with a traditional mill. In either case, the process is relatively slow compared to normal mass production. The concern here clearly isn't with large-scale arms control, as any big player (drug cartels and the like) would have the resources to buy firearms en masse and wouldn't want to bother with the slow, one-part-at-a-time process with a Ghost Gunner.
So is there a practical risk with the Ghost Gunner? In my opinion, the risk is relatively low. A criminal who wants an untraceable gun has much better, simpler and cheaper options.
Taking political and other concerns out of the equation and focusing only on the practical risk, my conclusion is that the practical risk posed by 3D-printed firearms is relatively low with the current state of the art. In just about every case, criminals or terrorists who want to use a firearm for their crime have much better alternatives and wouldn't bother with the cost, effort and risk associated with 3D-printed weapons.
The views and opinions expressed in this article are those of the author and do not necessarily reflect those of Linux Journal.
Kyle Rankin is a Tech Editor and columnist at Linux Journal and the Chief Security Officer at Purism. He is the author of Linux Hardening in Hostile Networks, DevOps Troubleshooting, The Official Ubuntu Server Book, Knoppix Hacks, Knoppix Pocket Reference, Linux Multimedia Hacks and Ubuntu Hacks, and also a contributor to a number of other O'Reilly books. Rankin speaks frequently on security and open-source software including at BsidesLV, O'Reilly Security Conference, OSCON, SCALE, CactusCon, Linux World Expo and Penguicon. You can follow him at @kylerankin.
