A home 3D printer is a careful machine, but also a dumb one. It can't tell the difference between a firearm and a firehose. It reads a list of movements, heats a nozzle, and lays down plastic or metal in thin layers until a shape appears. That list can describe a bracket for a shelf, a replacement knob for a dishwasher, or a receiver for a firearm. To the printer, those files are the same kind of thing: geometry.[1]
On 26 September 2026, California Governor Gavin Newsom signed Assembly Bill 2047, the California Firearm Printing Prevention Act, Chapter 461 of the Statutes of 2026. The stated aim is to stop untraceable “ghost guns” and machine-gun conversion devices at the machine, before a print job starts. California already makes unlicensed firearm manufacture a crime. The new law tries to force the tool to decline the job.
Existing printers are exempt, and their ownership and use are not banned. Sales and transfer become unlawful only after a chain of conditions. Starting no later than 1 July 2027, the state Department of Justice must check every quarter whether the standards body ASTM International has published an industry standard for “firearm blocking technology.” If it has, and if the department decides the standard and shows the technology is feasible, the department has 24 months to write performance rules. One year after those rules are written, any printer sold or transferred for money in California must carry hardware or firmware that will not start a job until a detection algorithm clears the file to print. If no ASTM standard exists by 1 July 2029, the department’s duty to keep looking ends. A standard published near that cutoff would push any sales rule into the early 2030s.
The definition of blocking technology is very specific. It means the printer will not proceed unless the file has been judged not to produce a firearm or a machine-gun conversion device (a small plastic part, often called a switch, that can turn a semiautomatic pistol into a fully automatic machine gun). Printers used only for entertainment props are exempt. The signed text dropped the criminal penalties, fines, and manufacturer attestations that earlier drafts carried.
California is not alone, and it is not the first state to implement such legislation. New York, in the budget Governor Kathy Hochul signed on 28 May 2026, requires blocking technology on printers sold in the state, but only after a working group and the Division of Criminal Justice Services decide it is feasible. Sellers who jump the gun face a civil penalty of $5,000 per machine. New York also made distribution and possession of certain blueprint files a felony. Colorado, in a bill Governor Jared Polis signed on 5 May 2026, prohibits unlicensed use of a 3D printer or a CNC mill to make firearms and certain parts; sponsors stripped a proposed ban on the files themselves, saying they would try again. Washington, in a law signed in March 2026, restricts use of printers and computer-controlled mills to make specified firearms and conversion devices, and addresses the digital files used to create them. An Associated Press report in June described the New York and California approach as an attempt to set a national equipment standard by legislating in two of the largest state markets.
The trouble is that the machine still cannot tell a gun from a hinge with the reliability a sales ban assumes. The simplest detector compares a file to a library of known designs, the way an old antivirus program matches viruses by a fingerprint called a hash. A hash is a short, unique string derived from every byte in the file. Change the file by a single invisible character, and the hash changes, while the printed object does not. Cody Wilson’s Defense Distributed project made its point against the New York model by appending bytes that scramble the fingerprint while leaving the part functional. A list of forbidden files is outdated the moment they are compiled.
In response, legislators reached for geometry, requiring blocking software to look at the shape, not the name. That is harder, and the published research shows both the appeal and the limit. Laura Garland and colleagues, in “3D printed firearm identification: A comparison of machine learning models” (Journal of Forensic Sciences, first published 27 April 2026), classified firearm and non-firearm objects from the G-code a printer executes. Reconstructing a mesh from the toolpaths and feeding it to a random-forest classifier reached 95.80% accuracy under cross-validation, better than reading numbers straight out of the code. That is a real result on a prepared set. It is not a detector that has to run, unattended, on every file a stranger in Fresno might send to a new printer.
Neil J. Joshi, Marie Chau, and David R. Casselbury pushed the same question from the other direction in “Towards Safer Makerspaces: Classifying Nefarious 3D-Printable Objects Using Machine Learning,” presented at the 2025 International Symposium on Academic Makerspaces. They gathered more than two million ordinary design files and tens of thousands of files for firearms and weapon components. Classic shape descriptors did poorly. A neural net built for point clouds, PointNet++, reached a preliminary area-under-the-curve of 0.8568 on held-out data. Useful for a lab. Short of a standard that could reliably support a statewide sales ban. A score like that means many false positives and false negatives.
Those mistakes are the core of the enforceability problem, not a footnote to it. A false positive is a lawful print refused: a pipe, a tube, a camera rail, a cosplay prop, a fixture that happens to have a hole and a wall of the right thickness. The entertainment exemption is a confession that the state already expects the filter to collide with ordinary work. A false negative is the miss. Split the receiver into two halves that are innocent on their own. Scale it. Add a boss or a hole. Print a jig that guides a drill through a metal blank you bought at a hardware store, which is how many homemade firearms are finished today. Jenna Martin’s 2024 Dartmouth honors thesis, “Geometric Identification of Tessellated 3D Models”, done in Solomon Diamond’s lab after the ATF asked whether a printer could decline a regulated part, showed that a simple shape test could pick out one known part, twelve times out of twelve, with no false alarms on 952 other files, in a few dozen milliseconds. The same work noted that the method learns a specific part, and that the cost of a miss and the cost of a false alarm are not the same. Extend that to every regulated part, every variant, and every object that merely resembles one, and the tidy demo stops being repeatable.
ASTM has not supplied the missing standard. On 28 August 2026, the organization said its staff does not write standards, that it did not lobby to be named in the bill, that it takes no position on the legislation, and that its additive-manufacturing committee had not taken up voluntary standards for this problem. Volunteer members may choose to. They have not. A mandate that waits on a document the named body has not agreed to draft is a mandate with no, forgive the pun, trigger. The Association of 3D Printing, which has supported the bills, has said in the same breath that the scheme will not work and reads as a political statement.
This pattern is old. States rarely ban physical facts, so they ban their description, or the tool that makes the description useful. The sixteenth-century Index of Forbidden Books did not stop heliocentrism; it licensed anyone who could read the arguments. The Ottoman ban on Arabic-script printing, held for most of two centuries, preserved theology less than a guild of scribes. Export rules that treated a mathematics paper as a munition did not keep algebra at home. Safety is sometimes the honest motive, as with live smallpox or weapons-grade fissile metal. Far more often the regulated object is a text, a drawing, or a machine that makes texts and drawings cheap. Control of the information becomes the point, because control of the object has already failed.
A print file is a set of instructions, and instructions are speech. The Electronic Frontier Foundation made that argument against AB 2047 while it was still a surveillance mandate: a required scanner censors lawful designs, pressures open-source printer firmware to carry approved filters and chills the ordinary trade in models that makerspaces run on. The signed bill is less restrictive than the draft EFF attacked. That bill still treats a geometric description as something a state may interdict at the point of sale of a general-purpose tool.
The United States already ran this experiment, with encryption. For years Washington listed strong cryptography as a munition. Publishing good code could be charged as an illegal export. In June 1991 Philip Zimmermann released Pretty Good Privacy, a program that let ordinary people encrypt email. The software reached the internet. US Customs opened a criminal investigation that ran three years. In January 1996, prosecutors closed it without an indictment. Zimmermann had not won a lawsuit. He had outlasted one. The precedent arrived through Dr. Daniel J. Bernstein, a mathematician who wanted to publish his own encryption source code and was told to get an arms-export license first. In Bernstein v. United States Department of Justice, a federal court held that source code is speech, and a Ninth Circuit panel agreed in 1999. The government rewrote the rules, the case was overtaken by the rewrite, and by 2000 Washington had largely given up treating public cryptography as a weapon. The practical result is the one that matters. Strong encryption is in every browser. The attempt to keep the knowledge in a vault failed because the knowledge was a text, and texts moved.
China and Russia do not share that settlement. Both treat detailed technical files, encryption without a back door, and unauthorized manufacturing data as things the state may seize, license, or punish. Russia’s civilian gun law is a permit regime wrapped around a propaganda law; China’s is closer to a prohibition, with the added machinery of the Great Firewall for anything that might teach a workaround. California has not built a firewall, and while it says a contingent sales rule establishes a secret police organization, the family resemblance remains. Governor Newsom signed a bill that makes a general-purpose tool inspect a citizen’s files and refuse anything the state has not approved. That is the same instinct China and Russia industrialized: knowledge is allowed only when it stays in bounds, and the people who already have the factories draw those bounds.
The knowledge isn't new, and the tool isn't special. People have made firearms with files, drills, and lathes since the early nineteenth century. Sheet steel, tubing, and a rivet produced the Liberator pistol of the Second World War, distributed as a disposable weapon. A garage milling machine has been able to cut a receiver for decades. A cheap printer changes the price of a shape, not the shape's existence. Legislation like this raises that price a little for people who buy a new branded machine in state and don't know how to change a setting. It invites the usual replies: an older printer, a printer bought in Nevada, open-source firmware, a model split into dull pieces, a CNC mill the statute forgot to mention, or a hacked device. Clever people treat a barrier as a specification.
Attempts to legislate a limit on that kind of knowledge fail for the same reason the cryptography rules failed. They pick a format, and the format changes. They pick an institution to write the standard, and the institution declines. They demand an accuracy the peer-reviewed classifiers have not shown outside a curated set. They collide with the rule, already tested in the Bernstein litigation, that code and technical description are protected speech. A law that cannot start until a private body volunteers a standard, and that cannot work if the standard arrives, is not a safety system. It is a claim that the state may stand between a person and a description of a physical object, between a person and a thought. That claim is morally repugnant in a republic that lives on the idea of free speech. It is likely unconstitutional and almost certain to fail.
This article used AI to craft the content and is shared at no charge for educational and informational purposes only.
Red Sky Alliance is a Cyber Threat Analysis and Intelligence Service organization. We provide indicators of compromise information (CTI) via a notification/Tier I analysis service (RedXray) or an analysis service (CTAC). For questions, comments, or assistance, please contact the office directly at 1-844-492-7225 or feedback@redskyalliance.com
- Reporting: https://www.redskyalliance.org/
- Website: https://www.redskyalliance.com/
- LinkedIn: https://www.linkedin.com/company/64265941
Weekly Cyber Intelligence Briefings:
REDSHORTS - Weekly Cyber Intelligence Briefings
https://attendee.gotowebinar.com/register/7855487668891299929
[1] https://six3ro.substack.com/p/the-shape-on-the-build-plate
Comments