No, Your 3D Printer Doesn’t Have a Fingerprint

Hackers and makers see the desktop 3D printer as something close to a dream come true, a device that enables automated small-scale manufacturing for a few hundred dollars. But it’s not unreasonable to say that most of us are idealists; we see the rise of 3D printing as a positive development because we have positive intentions for the technology. But what of those who would use 3D printers to produce objects of more questionable intent?

We’ve already seen 3D printed credit card skimmers in the wild, and if you have a clear enough picture of a key its been demonstrated that you can print a functional copy. Following this logic, it’s reasonable to conclude that the forensic identification of 3D printed objects could one day become a valuable tool for law enforcement. If a printed credit card skimmer is recovered by authorities, being able to tell how and when it was printed could provide valuable clues as to who put it there.

This precise line of thinking is how the paper “ PrinTracker: Fingerprinting 3D Printers using Commodity Scanners ” ( PDF link ) came to be. This research, led by the University at Buffalo, aims to develop a system which would allow investigators to scan a 3D printed object recovered from a crime scene and identify which printer was used to produce it. The document claims that microscopic inconsistencies in the object are distinctive enough that they’re analogous to the human fingerprint.

But like many of you, I had considerable doubts about this proposal when it was recently featured here on Hackaday . Those of us who use 3D printers on a regular basis know how many variables are involved in getting consistent prints, and how introducing even the smallest change can have a huge impact on the final product. The idea that a visual inspection could make any useful identification with all of these parameters in play was exceptionally difficult to believe.

In light of my own doubts, and some of the excellent points brought up by reader comments, I thought a closer examination of the PrinTracker concept was in order. How exactly is this identification system supposed to work? How well does it adapt to the highly dynamic nature of 3D printing? But perhaps most importantly, could these techniques really be trusted in a criminal investigation?

The Elephant In the Room is a Red Herring

We can certainly debate about how common it is for a criminal to employ 3D printed objects, but we can’t deny it’s possible. But interestingly, when we hear about the nefarious use of 3D printers in the media, CC skimmers and 3D-printed keys are rarely the examples given. It seems all anyone wants to talk about is printing untraceable “Ghost Guns”.

Hackaday printed a gun in 2013, and it sucked

Yes, it’s possible to create a rudimentary firearm on a $200 3D printer, but a far more reliable weapon could be built using $20 in parts from the hardware store. In the other extreme, a CNC mill can be used to produce a gun that’s not only untraceable, but legitimately practical. Yet we don’t often see calls for more regulations on the products sold by Haas or Bridgeport. A 3D printer is arguably the worst possible way an individual could produce a firearm, but thanks to their low cost and high availability, some would have you believe a Monoprice Mini is little more than a personal weapons factory.

One thing is abundantly clear, 3D printing isn’t going anywhere. If today we already have a handful of verified examples of 3D printers being used to commit criminal acts, it would be naive to think it won’t happen in the future as the technology gets better. But for the purposes of this article I’m not considering firearms as they are are not a viable 3D printable item in the foreseeable future. This 3D printed gun was crappy six years ago, it’ll still be crappy if printed today, and all signs point to it being crappy in another six years. So fix your mind on present-day crimes being committed with 3D printers, and credit card skimmers are the gold standard in real-world examples.

Matching 3D Prints to 3D Printers: The Burden of Proof

PrinTracker is the marketing-speak for the research paper outlining a way of forensically identifying what type of 3D printer was used to produce a given print. At first glance, the PrinTracker method sounds plausible enough: by closely examining a printed sample, visible manifestations of the printer’s hardware and software configuration such as extrusion rate, nozzle diameter, temperature stability, and acceleration can be observed and cataloged. With a large enough database of these observations, the lineage of a printed object can be determined by comparing its surface irregularities to that of previously identified printers. In principle, this is similar to how a fired bullet or ejected cartridge can be matched to a given firearm.

Examining the “fingerprint” of a gun

But as you look deeper into the report, it quickly becomes clear that there are some serious issues which would prevent this technology from being useful in the real-world. For one, the authors note you would need to build and maintain a database of “fingerprints” for every possible permutation of hardware and software. In the same way a human fingerprint found at a crime scene needs to be matched to one already on record, PrinTracker would only work if there was already a cataloged example that the print under investigation could be matched to.

Attempting to build such a database of even just the commercially available printers would be a monumental undertaking, and that wouldn’t even take into account custom designed printers or those built from kits which might exhibit different behavior from pre-built models. There are simply too many machines, controlled my too many software packages, to hope to catalog them all.

To that end, the paper suggests that 3D printer owners could someday be required to not only register their printers, but provide regularly updated samples of printed objects to be added to the database. Without such an Orwellian system, the paper concludes that PrinTracker could not determine which specific printer actually produced an object, but at best only the make and model which was used.

In light of these facts, it seems conclusions drawn by PrinTracker would be circumstantial at best. Not only is there a high probability that the system won’t find an existing match in the database, but even if does, it cannot say conclusively that the print under examination was made by a specific printer. To return to the ballistics example, it could not identify the particular gun, it could only verify that it was the same model of gun used to commit the crime. This might be a corroborating data point, but it’s not enough to condemn the suspect.

An Exceptionally Narrow Scope

Be that as it may, every journey must start with the first step. PrinTracker may not be a perfect solution, but it’s certainly worth researching. So if we ignore the logistical issues of implementing the system, does the method itself hold up to scrutiny? Unfortunately, that’s not terribly clear either.

According to the paper, testing was limited to just five models of FDM printers. But even with so few printers examined, one would think that variations in software configuration should have been enough to make identification more difficult. After all, manipulating various parameters to produce noticeable changes on the final print quality is how these machines are fine-tuned. Yet according to the paper, the system was tested with only the most minute adjustment to print settings:

PrinTracker is resistant to the variation in printing parameters within 120 – 100 mm/s nozzle speed and 0.06 – 0.15 mm layer thickness in different materials. Out-of-range configuration might pose a risk of spoofing our solution, but the products will suffer from severe deformation and poor quality, which compromises the usability.

Dismissing print speeds outside of the tested 20 mm/s range or layer heights higher than 0.15 mm because they would cause “severe deformation” is disingenuous to say the least, and is a claim which holds absolutely no weight to anyone who owns a 3D printer. For rapid prototyping one might use a layer height as thick as 0.3 mm and run at high speed, but for high detail work, switch to a “low and slow” approach. The reality is that wild variations in speed and layer height are perfectly normal.

Of course, the software is only one half of the equation. What about when modifications are made to the printer’s hardware? According to the paper, when hotends were swapped between different printers, PrinTracker was unable to identify any of the test objects printed. Which is precisely what you’d expect, given the fact that it would completely invalidate the original observations.

But rather than acknowledge this deficiency, the paper frames this as evidence that the system cannot be fooled into producing a false positive:

Upon testing the scanned images using PrinTracker, we observe that the entire set of these images is refused and classified as an alien device. The reason is that the fingerprint not only generates from the manufacture variations but also from the complex integrated effect of mechanical components. Thus, PrinTracker would remain unaffected.

Both of these explanations appear to be clear examples of confirmation bias. Modification of the software and hardware of the printer is common, perhaps even expected. But here modified printers are dismissed as inconsequential outliers. If all it takes to evade detection is a new hotend, or altering print settings, what good would this system be?

Active Countermeasures

We must also consider the possibility that a criminal would actively try to obscure the identity of their printer, in the same way serial numbers may be filed off of a gun. The paper touches on this subject as well, but here again the testing method doesn’t appear to be rigorous enough to make any clear determination.

For example, they describe a “Scribbling Attack”; wherein a criminal would apply something to the surface of the print to make it harder to examine visually. In the paper, this is simulated by dabbing a marker onto the surface of the print. But the testing procedure takes something of an unexpected turn:

We observe that alcohol can be used to clean the ink from the key’s surface effortlessly. We test the scanned images of the cleaned surface’s texture with results showing an accuracy of 100%, implying the PrinTracker has a high tolerance to the scribbling attack.

As difficult as it is to believe, rather than actually testing if PrinTracker could identify prints which had been obfuscated in this manner, they simply removed the ink before scanning them and claimed the test to be a success; completely ignoring the actual question being posed.

Even if we grant the somewhat questionable determination that any ink or paint applied to the print could simply be removed before scanning, that doesn’t take into account physical alterations to the surface. What if the attacker took a sander to their printed object, obliterating all surface detail?

This is considered in the paper as a “Scratching Attack”, but here again the legitimate question seems largely ignored. In this test, only a small section of the object’s surface area was smoothed out with a file before testing. Why would a criminal who is actively trying to avoid detection only obfuscate a tiny fraction of the surface detail? The level of abrasion in this test looks closer to normal wear and tear, and is likely something that should have been considered in the baseline performance of the system.

Adding Fuel to the Fire

It seems obvious that the testing described in the paper was not nearly rigorous enough to take into account the vast number of variables which impact the appearance of a 3D printed object; unintentionally or otherwise. But this is also first of its kind research, so there’s perhaps a little leeway to be given. It’s not perfect, but at least it poses an interesting question.

Unfortunately, what could have been the start of a useful dialog is mired by the same dubious claims against 3D printing that we’ve seen time and time again. Rather than focus on plausible scenarios such as printed credit card skimmers or duplicated keys, the paper references objects which can only be called the products of fantasy:

After the attack is conducted, he leaves the crime scene without leaving any personal marks such as body hair or fingerprint. Instead, he unintentionally or intentionally abandons the tool at the crime scene (e.g., credit card skimmer, cartridge case or magazine) or is unable to retrieve the broken object due to certain circumstances (e.g., grenade debris or broken key in the lock cylinder).

They double down on these examples as part of their official testing procedure, as seen in Figure 20:

This paper is insinuating, either through an intent to deceive or a woeful ignorance, the existence of functional 3D printed grenades and ammunition. These are ideas which belong to the realm of science fiction, and their inclusion in a scholarly paper is completely inappropriate. Printing out objects which look like a hand grenade or bullet without clarification that they’re completely inert is a distraction from the real point of the paper, and further strains the legitimacy of the already questionable conclusions the document draws.

A Missed Opportunity

There are several issues with “PrinTracker: Fingerprinting 3D Printers using Commodity Scanners” that stand out to anyone with experience in 3D printing. Not enough printers were tested, crucial variables are either ignored or underplayed, and the choice of reference objects play into unfair tropes about the technology. Which is really a shame, as there was a chance to perform some valuable research here.

A truthful examination of visual print identification, which took into account a realistic array of software and hardware variables and avoided unproductive security theater would still have been first of its kind research. Alternately, the team could have looked at the problem from the other side, and investigated current or near-future methods of “watermarking” prints, such as 3D steganography. This is already something we’ve been seeing in more thoughtful media portrayals of 3D printing , and research into the practicality of these methods would have likely garnered considerable interest.

Instead, we are left with only hints at what could have been. While it wasn’t the intent, this paper seems destined to spread more fear, uncertainty and doubt about 3D printed firearms or other criminal implements. Before long we’re going to need to address the bad actors who want to turn additive manufacturing against society, but it will take something a lot more comprehensive than PrinTracker to do it.