Hacker News new | past | comments | ask | show | jobs | submit login
High-end CNC machines can't be moved without manufacturers' permission (boingboing.net)
171 points by aaron695 on Jan 7, 2014 | hide | past | favorite | 107 comments



This is completely beside the point of the article, but I work for a company that makes fairly large precision equipment. A potential service nightmare is when the customer moves the equipment and screws it up. A lot of this equipment is designed to only be installed by the supplier, due to the amount of documentation and training that would be needed for customer installation. And something like a big CNC may have some fairly detailed site and installation requirements.

Maybe the GPS is so it can receive targeted ads. "Customers who machined this part also ordered..." ;-)


Well, I know it took me ages to get my half decent hobby lathe (Myford) perfectly setup for my own hobby use, which is possibly the least accurate form of machining out there. (No, Im not making bombs, I'm making parts for silly, RC usually, models!!!) So, I can well see high end CNC machines having to be very precisely set up, and I can also see that being a fairly long, PITA job. Frankly, if we are talking maintenance on CNC machines worth $100k, or whatever, I'd want some lock down and historic data. Does make sense.

So, I think where contracts are in place, they have every right to lock the machine down. Which is probably part of any contract. But, putting aside what I was saying about nukes, I can't see why, if there is no contract, an owner has to have his machine bricked if (s)he wants to move it. Again, unless these machines are specifically restricted by law or international treaty type things.


Reminds me of a story from the other end of the skill ladder - as a student, I had a short-term job in a hosiery factory, ostensibly to help move a couple of very heavy machines around, with the rest of the time doing stockroom work. The Day came, the crane operator came along and told us to keep clear, and we didn't lay a finger on the machinery. Us hired meat just went back to the stockroom, fine by us.

Incidentally, if you're looking for easy stockroom work, a hosiery factory has no heavy lifting...


If that's all they were concerned with they could just use GPS readings to invalidate the service agreement rather than switching the machine off.

In any case, I wish that Congress would step up and put law around the issue of whether one can "sell" things with restricted use. E-books, for instance, are really leased rather than sold. A sane legal system would give teeth to that legal distinction.


In this case they're claiming that Congress required them to restrict the use.


Yeah that sounds like a valid reason, too. These things work with millimeter accuracy; jolt them and the accuracy may be off. Position them just slightly off-level and they might be off.


You're off by 3 to 5 orders of magnitude depending on the specifications of the machine and kind of work it's doing. Isolating these machines from outside vibrations as well as canceling out their own internal harmonics is no small engineering feat and typically involves pouring a concrete slab custom for the setup. Beyond keeping up export restrictions and avoiding bad installations I can see it as a way of avoiding warranty fraud with user error or crane accidents.


Oh no not that meme again.

The reason why machinists who know only a little about machining demand you must level a lathe bed or it won't work, insist on that old wives tale, is because a simple "cheap" way to prove the lathe bed isn't twisted is to simply plop a precision level on various parts of the lathe bed and various directions... If the lathe bed is level everywhere, it must be a flat plane (well, plus or minus curvature of the earth over 100 foot monsters, obviously)

Obviously machine tools don't have to be level; otherwise you'd never see them on ships, deep sea platforms, mobile "back of truck" repair trucks, things like that. They have other, somewhat more laborious or expensive ways to determine and shim flatness.

If you made the flimsiest imaginable 3-d printer, then sag might be relevant... however you're talking about beasts of a machine that can drop 10-100 rotating HP and not twist or distort... anything less than 45 degrees isn't going to matter.

Now one problem I have personally seen is some CNC gear has what boils down to a conveyor belt that streams out metal chips. So if you mounted it 10 degrees tilted, you might have chips not fall on the conveyor belt. This is usually a simple adjustment to various guards / guides / baffles. Its not a very serious concern.

As a cross industry comparison, learned helplessness is a common feature in IT/CS land, where your average luser is extremely proud to not know anything about his computer that he uses 8 hours per day, and no one expects him to know anything either. However in machine world its somewhat unusual to have IT-like levels of learned helplessness, so the average machinist dude can quite easily handle shimming a lathe or adjusting tilts and such.


Is it possible that tools meant for ships/oil rigs/trucks are built differently from those that have the luxury of sitting on a stationary floor?


They're almost certainly not expected to work to anything near the level of precision that these sorts of high-end CNC machines do - judging by the comments in this thread, you're talking about micrometer level precision. They are to 'machine-tools' what your home server is to google's data centres.


Point well taken about the cutting force probably dwarfing external forces imposed by minor tilting.


Your quiet right though I think you meant micrometer not mili.

Machine tools do need a nice really really flat surface to work on when you working to micrometer or single thou's of tolerance even the smallest tilt in the x or y plane is unacceptable - you probably also want a very stable temp environment.

ps I never thought id have the chance to use the old unit "thou's" in a hn comment


Your comment implies that micrometers and thous aren't an order of magnitude different. Regardless of which one you are talking about small tilts are not going to make a big difference. As long as everything is lined up properly within the machine then you aren't going to have a problem. Hell, even if it is a horrible, cheap, backlash ridden machine it is quite possible to machine something down to 1 thou tolerance provided you are careful and know a few tricks. I'm not even trained as a machinist and I have done that without too much trouble.


you said "These things work with millimeter accuracy" what I said was I think you meant Micrometer which is 3 orders of mag different.

I just added thou's is as a courtesy to this in the USA who still use imperial



Another possibility that hasn't been mentioned is that the purchase agreement might include some kind of first refusal for the manufacturer to repurchase the equipment if the original owner wants to sell. This kind of provision prevents the emergence of a used-equipment market, the existence of which would cut into the manufacturer's pricing power on new equipment. Requiring the manufacturer's consent to relocate the equipment would be one way for the manufacturer to enforce such an agreement.

tl;dr if you sell expensive machinery then do everything in your power to prevent buyers from reselling.


The market isn't small enough for these tactics to work.

It's much more likely that this was a response to the very real and well documented problem of illegal exports. Another Japanese company, Mitutoyo, was caught several times illegally exporting these machines to embargoed countries, including North Korea and Iran. Some of Mitutoyo's executives were jailed for this.[1] Adding tamper-proofing and tracking is a great way to make sure that regain confidence and avoid prison.

Edit: I'm not sure why this was downvoted. A representative from Mori said something similar on the board linked to by the original article:

"Regarding the device, Weapons of Mass Destruction. Worst case for a negligent violation would be Dr. Mori himself spending time in the slammer. That along is enough motivation for DMG MORI to follow the regulation very carefully. Other reasons include all of those stated above!

btw, no need to waste time on bypassing it. It is pretty solid. We have to make it so Iran, N. Korea, etc's best can't bypass it." [2]

I think that this is a perfectly plausible explanation and don't think that the real ulterior motive is controlling resale, especially when other foreign competitors do not have the same restrictions.

[1] http://www.japantimes.co.jp/news/2006/09/02/news/mitutoyo-ti...

[2] http://www.practicalmachinist.com/vb/dmg-mori-gildemeister-m...


Then why not just white-list all the areas not covered by the embargo so customers are not required to got trough this lengthy procedure every time they want to re arrange the shop.

Also it's not very difficult to trick a GPS sensor into thinking its somewhere else as long as your signal is a lot better then the ones coming from the satellite so i would disagree with them being solid.


> it's not very difficult to trick a GPS sensor into thinking its somewhere else as long as your signal is a lot better then the ones coming from the satellite

and that's probably the reason why they include a gyro and shut down the machine if it is moved at all, regardless of what the GPS says.


And once you're dome moving it you fake your location by spoofing the GPS and call to get it activated again and none's the wiser.

A gyroscope doesn't do much besides detect if it was moved it can't tell where it was moved so you're basically relying on spoof-able input.


That's not entirely true. Early navigation was done with gyroscopes, see http://en.wikipedia.org/wiki/Inertial_navigation_system specifically:

"The INS is initially provided with its position and velocity from another source (a human operator, a GPS satellite receiver, etc.), and thereafter computes its own updated position and velocity by integrating information received from the motion sensors. The advantage of an INS is that it requires no external references in order to determine its position, orientation, or velocity once it has been initialized."


While it is true that INS's exist, the cost of a reliable and accurate one is on the same order of magnitude as the CNC Machine itself. Also, errors accumulate [0] over time in an INS (aka "Integration Drift"), such that it becomes wildly inaccurate after a certain critical threshold. Also, almost all INS's require regular calibration and tuning, [1] and are sensitive to vibrational stresses (which is abundantly present in a machine shop). Therefore it seems unlikely that these machines include INS's.

[0] http://en.wikipedia.org/wiki/Inertial_navigation_system#Erro... [1] http://www.aerostudents.com/files/avionics/navigationBasicsA... (scroll down to bottom for tuning discussion)


Again, it is true that drift exists, but you're mischaracterizing, from [0]: "these errors accumulate roughly proportionally to the time since the initial position was input. Therefore the position must be periodically corrected by input from some other type of navigation system." [0]http://en.wikipedia.org/wiki/Inertial_navigation_system#Erro...


One good earthquake will cause some real problems...

I find it interesting that the GPS is even receiving signals inside of a machine shop. One would think that the interference from the machine itself, not to mention the typically metal building, would attenuate the already weak signals pretty badly.


You misunderstand, I think. The gyro detects movement, and the machine becomes locked until the manufacturer decides to unlock it for you. When deciding whether to re-enable the machine, the manufacturer can verify its new location using whatever means they want.


Isn't that a problem for Customs to worry about?


Wasn't there a YC company whose business is to resell semiconductor capital equipment? Must be a bit of a goldmine business.

edit: Found them. http://www.asseta.com/


> Effectively, this means that machinists' shops can't rearrange their very expensive, very large tools to improve their workflow from job to job without getting permission from the manufacturer (which can take a month!), even if their own the gear.

Have you ever seen such a workshop being rearranged? The people doing it might - for instance - not place the machine on a good enough quality of flooring, or they might be moving to a facility that is totally inappropriate (no good foundations) because they aren't talking to the right people and have a dim and naive view of machinery...

Also my experience of such rearrangements is that they are not to improve workflow, but more usually to satisfy some new management type's desire to have an impact on the workplace.

In short, I think this is prudent - it at least prevents a classic engineering management cock up - and protects the machine manufacturer from having their name tarnished by the sloppy practices of their customers.

The case where people know what they are doing is the exception and not the case in my experience...


Two things:

- a GPS lock can easily be defeated by the earnest with a GPS simulator, about a $2k fix. This isn't a great solution for the honest buyer, but anyone with ill intention could easily activate these in Kansas and re-export to a controlled state.

(edit: a GPS sim can't help with the gyros, so maybe its a better "lock" than I originally reckoned ;-)

- there are excellent "open-source" substitutes available. The Mechmate community is thriving (http://mechmate.com) and these plans make it possible for a DIYer to build their own 4 axis CNC with tolerances to a thousandth of an inch or better. My father-in-law is a a cabinet maker (http://woodforyou.net) who built one of these for his business a few years ago, here's a demo video showing his results... http://www.youtube.com/watch?v=lU3-6AapV3I

(Edit 2: I wrote this before I had an appreciation for the difference between a CNC mill and a CNC router. The Mechmate is a CNC router and used for very different purposes than a CNC mill. Anyways, comment might still have some value for some. Sorry for the noise ;-)


What happens when a GPS satellite fails? Or if you have an earthquake? Seems like precisely in those times of national need that one's most sophisticated technologies might be sorely out of commission. A seemingly pretty nice way to inflict 'collateral damage' on one's self. Especially if such a precautionary set of rules were put into more and more machines.


Consumer GPS devices have some interesting lock-down rules built into them. They shut themselves down if they detect you are travelling around Mach 2 or above 18000 metres altitude.

The reasoning is fairly obvious - they dont want to see dumb missiles getting upgraded to a DIY guided ballistic missile thanks to a $100 Garmin gaffa taped to the side and a cheap flight control computer.

http://en.wikipedia.org/wiki/CoCom


They shut themselves down if they detect you are travelling around Mach 2 or above 18000 metres altitude

The intention was for a GPS device to disable itself if it was traveling faster than 1k knots AND above 60k feet, not traveling faster than 1k knots OR above 60k feet. Unfortunately, many GPS devices improperly implement this as an OR condition, rather than an AND condition. This becomes problematic when using a GPS in a high-altitude weather balloon to determine altitude and location, which a few friends and I did a couple years ago. We had to be very careful when selecting the GPS we used to avoid this pitfall.


Which GPS units are acceptable for this? I'm working on a HAB and I'm worried about this CoCom bullshit. The one I'm thinking of uses a SiRFstarIII or IV; any idea of those use || instead of the proper &&?


Wikipedia article on CoCom links to a post that links to this page:

http://ukhas.org.uk/guides:gps_modules


(Apologies for the untimely reply)

We used a UBlox5, which we purchased from diydrones.com. This was in 2009, so that particular model is now outdated. Both Adafruit and SparkFun now sell devices which are explicitly listed as being HAB-friendly. There's also good guide at http://showcase.netins.net/web/wallio/GPSrcvrsvs60kft.htm. That page states that SiRF-I and II are known to fail above 60k feet, and that some SiRF-III-based receives fail, while others don't.

(If you happen to be in the Bay Area, I'd be happy to meet up and give you guys some pointers sometime; drop me a private email.)


Interesting, I did not know that. Which GPS did you end up using?


How about the GPS inside Android/iPhone?


Now I have this image of someone throwing a million dollars multi-ton machining center at mach 2 on a ballistic trajectory at his neighbor in the perfect combination of act of war, artistic performance, rich kid play and geeky curiosity ("do the GPS in this thing has the lock?").


> What happens when a GPS satellite fails?

The receivers use other satellites. They have to anyway: You can't get a fix with only one satellite.


I would imagine you normally need three. If I'm visualizing the geometry correctly, the intersection of three spheres is two points, and it should be easy to guess which of the two is the more likely location of your device.


Because relatively cheap GPS receiver clocks drift, typically 4 satellites are needed for a position. You can assume an elevation, especially at sea level, and solve a position with three satellites but this introduces other factors (ellipsoid vs geoid, satellite constellation geometry, etc) that can make a good position difficult to obtain.

In practice there are enough satellites that these considerations are theoretical. Most situations that would involve limited satellites also introduce stuff like multi path reflections that further degrade position accuracy.


Here is a graphic to add to that explanation if anyone is curious: http://gis.stackexchange.com/questions/12866/why-does-gps-po...


In North America your GPS probably connects to between five and twelve satellites.


The interlocks aren't permanent - they can be bypassed by the manufacturer.


I'm not sure you actually meant it as a joke, but that's hilarious in a cynically-detached kind of way. So these machines are not bought but licensed and they will fail as soon as the manufacturer becomes unable to continually grant usage rights, i.e. during a region-wide catastrophe.


I'm merely pointing out that GPS outage would be no more than an annoyance. .

If the machinery experiences significant acceleration in an earthquake, it's not necessarily intact or safe to operate afterwards. The enclosing machine shop is also not likely to be in any state to continue operations if something as large as the pictured CNC machine has been thrown across the room. I don't buy that this issue is a big deal either.

From a software freedom standpoint, yes, this is terrible. But I don't think it's as much of a problem for the owner as the parent suggests.


I have no idea how many of these machines are in a given area, but assuming it is an IMU [1] triggered lockdown, an earthquake could lock down many (10?, 100?, 1,000?) in a single geographic area very, very quickly. That seems like a big problem.

If the lockdown mechanism is GPS, then it should be clear where the actual machine is, so there shouldn't be any need to lock it down unless it's in a black zone.

And what happens if the manufacturer goes belly-up?

[1] https://en.wikipedia.org/wiki/Inertial_measurement_unit


I don't know about the one mentioned, but I've used very high end CNCs. The ones that I used are VERY carefully calibrated by the manufacturer on site. A slight change in the slope of the floor could throw the calibration off. They wouldn't want to spend time troubleshooting a problem caused by somebody moving the equipment. That said, we didn't have anything like a GPS on the thing that would shut it down if moved.


Then better implement something like the "tainted mode" in the Linux kernel: if you load a closed-source (tainted) module, you can continue to use it, but the vendor (in this case the kernel developers) will refuse to give support.


Slightly off topic, but I'm working in that field, and those high-end CNC run nothing more elaborated than windows XP. They do ship some linux distro, but that's very seldom, much more than... windows nt4.

The CNC must be reachable from the programmers computers as well as from the remote connections that manufacturers sells as maintenance. Needless to say, it's a nightmare for any decent CISO.

Of course the CNC manufacturers' don't make it easy nor encourage the installation of third party securing tools. Very big companies spend a lot of time thinking on how to secure such machines on their network without touching the OS, and I've not yet heard of someone having found a simple and powerful securing policy (not involving a complex vlan implementation). The result is that, with some hacker abilities and a known target, one could worm its way threw the CNC OS of a lot of companies who don't know nor want to secure their network.

If one fellow colleague working on the manufacturer side happen to read that comment, I would be happy to push the discussion further.


> a complex vlan implementation

How exactly are they setting this up that it's complex? Isolated VLANs with VPN access are a routine solution to this kind of problem. A decent network engineer would probably have it done before you finish telling him what you want.

(If instead of a decent network engineer, I had to do it, I'd just be finding the password for the switch I hadn't logged into for a year. The configuration would be done about 15 minutes later.)


From my experience, there's a tremendous lack of decent network engineer in those companies (mechanical industry, family business, ...).

Devil advocate: people in charge of IT stuff there are project or support guys, almost never network engineers. Either they don't care about serious security or they simply have no clue on how they should do it. And when they outsource their IT security, they're so bad at choosing that the solution implemented is worst than doing nothing.

When I have the chance to chat with them about those subjects, the common position is almost always "we don't get why the machine manufacturer don't sells us a secured solution".


Same for medical equipment. The Windows XP EOL is a major problem because all of this kit has been "certified" to run with XP, and re-certification is costly.

There might be a market for a $50-100, two-port firewall/DMZ solution built on one of these ARM chips:

http://www.freescale.com/webapp/sps/site/prod_summary.jsp?co... http://www.ti.com/product/am3357

I have yet to find such a solution for sale.


That is a rather misleading headline. A better one might be:

"US arms export regulations force CNC manufacturers to implement anti-relocation lockout mechanisms"

Of course it's not just the manufacturers being dicks; they implement that or they can't import to the USA.


With the irony being that the only ever country to use nuclear weapons is enforcing something on the only ever country to receive those weapons, in the name of nuclear weapon control.


Really? I thought the vendors just can't sell to Iran, not that they have to build in lockouts that enforce compliance by their customers.


According to the thread the story is taken from, the machines are now under the purview of ITAR: http://www.practicalmachinist.com/vb/dmg-mori-gildemeister-m...


Manufacturers of ITAR controlled devices typically have to enforce compliance by their customers. If there's a method to enforce compliance and it isn't present, the manufacturer can be held responsible for the export. Some things (such as mirrors for lasers) can't really be enforced while others (large machines, aircraft) can be.


Iran is in another corner of the installed workroom?


We should not be too surprised at this. As long that property laws can be circumvented with technology, more companies will get into the business of retaining full control after sale. With practically no drawbacks and only benefits, it goes against economics to not do it. It doesn't matter if its a CD, game, website, a car, a high end CNC, or a coffee maker. Retaining effective ownership after sale is just so useful from a corporation point of view. Never again does a product need to escape into the control of an customer.

That this story might be explained with regulation is not much of an surprise. No US politician would dream of publicly stand for the view point of taking down private ownership and giving the control to corporations, even if regulations then can easier be enforced. They would be called communist and fascist, and any political career would be over. However, circumvention of property law is not the same thing, so it enables many new way to control what previous was hard if not impossible.


I don't think this uses GPS. A high-end CNC machine would have about 0% chance of seeing any GPS satellites.

Even the linked thread said it uses gyros without mentioning GPS.


The linked thread actually does have a couple, albiet tenuous, mentions of GPS:

  - "All of our Citizen swiss lathes have the same GPS feature." (http://www.practicalmachinist.com/vb/dmg-mori-gildemeister-maho-cnc/mori-ellison-gyroscope-unlocking-273841/#post2141101)  
  - "Why can't they simply check for "Out of USA" or "in $BannedCountry now"? They do have GPS, right?" (http://www.practicalmachinist.com/vb/dmg-mori-gildemeister-maho-cnc/mori-ellison-gyroscope-unlocking-273841/#post2141382)


I agree, and if it would use GPS then they could do the blocking only if it leaves the country, so probably the sensor is just a simpler accelerometer.


A rather interesting/insightful comment from the article: http://bbs.boingboing.net/t/high-end-cnc-machines-cant-be-mo...


Not really. There is a lot of logic failure in this comment.

What does the fact they don't install them on US machines have to do with them not using it as a business opportunity? This is a non-sequitur.

Since this guy hasn't heard of them being used to enforce finance deals means absolutely nothing, how could anyone cancel out a point because of that?

And his third point skips out on the fact that adding this functionality to the machine can cause extra problems.


I might be missing a huge point here, but aren't very high precision, high end cnc machines virtually vital for the production of nuclear devices? If thats the level of machine we are talking about, I can well understand this.


They were not 'vital' in 1945. And were not 'vital' 40 years after that. It may be convenient but far from vital.


So are computers. Should computers be shipped with mandatory GPS units that shut them down when they go into "bad guy" countries?


Have you not seen the paperwork that come with high end computer equipment - I helped by some Pr1me gear back in the day and along with the kit came a sheaf of paperwork explaining just how much shit you would be in if you reexported it to one of the country's on the naughty list.


I don't agree with the general theme of restricting things in this way. However, to be fair, powerful computing technologies are sometimes restricted from export to certain countries. It was only fairly recently that this sort of regulation was eased a bit wrt Iran.

http://news.cnet.com/8301-1023_3-57586991-93/u.s-lifts-ban-o...


Shh! Stop giving them ideas. Before long, being amidst an Occupy Wall Street type protest will result in your laptop shutting down.


That's not a bad point. I can see the desire to keep these away from certain places, but if that's the case, why geo-lock them so much? Why couldn't you allow a large region of GPS coordinates and add a mandatory blacklist of locations? Instead of solving the "problem" (stop the machines from working in Iran), the manufacturer turned this into a profit center. Blocking a company from rearranging their work floor seems a bit much.


I would guess that part of the problem is that relying entire on GPS would not be practical, considering the likelihood that many machines would be located within large warehouses or industrial buildings that block a GPS signal.

The article mentions that gyros are also used, so I suspect that the company prefers to have a defensible list of purchasers, with the confidence that this would not change without their knowledge.

Similar in results to a blacklist, but somewhat more reliable from the manufacturer's perspective.


GPS by itself could be easily spoofed. It's a well-known protocol that is broadcast in the clear.


Modern, fancy nuclear devices, perhaps.

But I suspect that the machining to make something that goes boom is probably well within the means of a traditional machine shop.


Cards on table...

My main knowledge of , er, building nukes (hello GCHQ) comes from the widely accepted to be well researched book by Tom Clancy, The Sum of All Fears. Apparently it is a very good account of how to make a nuke, but with some very crucial details missed out of changed. And, yeah, very fair enough.

What I got from reading that book only once was that, even for a nuke bomb made from the remnants of an old nuke missile ("hacked, if you will") was that a fair amount of very, very high precision machining was necessary. In the plot, it was a massive big deal to get the right machine tools (Swiss, IIRC), and that alone was a massive task. Not just getting the tools, but getting one person with the skills necessary to do that machining.

Now, could well be the case the the precision needed to make a nuke is much higher than the machines mentioned in the article, don't know. Also could be that in that book plot, they needed very high precision to maximise the yield from old material, and of course perhaps a relatively small amount of material. So, its quite possible my point is redundant.

Another thought. Might be that the machine tools in the book were manual, not CNC. Might be that you needed high precision tools and a highly skilled machinist. So two things to required to make the bomb. Might be that now you dont need the skills because high spec CNC enabled less skilled people to do the work. So, that might be even more reason to keep tabs on the machines.

And thats all I know(, or think I know). Im merely suggesting that this might be a good reason to bolt down high precision CNC machines tools.


The detonation apparatus for a fission bomb is trivial. Students can build them, and they have. Someone even brought one onto the floor of Congress to prove a point in a committee hearing on nuclear proliferation. Without the uranium, of course.

Achieving fusion is tricky and requires extremely precise machining (you basically have to build a perfect sphere). The detonation condition for fission is simply a critical mass of U-235 sitting in one place. Typical design is two piles of uranium in a container, separated by a lead wall. TNT blows the wall and drives the piles into each other; nature does the rest.

Fortunately, enriching uranium is a massive (expensive, time-consuming, and not particularly subtle) operation. Really only within the reach of states. But if you got your hands on weapons-grade uranium, the bomb part wouldn't be hard at all.

Source: my high school chem teacher.


"Typical design is two piles of uranium in a container, separated by a lead wall."

Even the simplest nuclear weapons design is slightly more involved than that - the gun-based design used in the "Little Boy" bomb that destroyed Hiroshima used an actual section of gun barrel to fire one chunk of uranium at the other.

More modern designs of fission bombs, either as stand-alone weapons or as primaries for H-bombs, are actually pretty complex - balancing the need to be efficient (plutonium and U235 are rather expensive), light, robust and safe is a non-trivial problem.

The W88 warhead with its prolate (egg-shaped) primary is the most advanced nuclear weapon that has had design details leaked to the public:

http://en.wikipedia.org/wiki/W88

In the case of the Sum of All Fears the terrorists were trying to build a strategic level bomb (i.e. hundreds of kt) using a fusion boosted fission design to try and start a global war - so they were actually trying to build something relatively advanced, not just a basic bomb.

Edit: Another real problem with working with plutonium is that it is fairly nasty stuff to deal with - I can recommend the book "Making a Real Killing: Rocky Flats and the Nuclear West" to get some idea of the horrors of working with plutonium on an industrial scale:

http://www.amazon.com/Making-Real-Killing-Rocky-Nuclear/dp/0...


True, but the prototypical modern terrorist doesn't need robust or safe, nor does he need to get the device airborne. He just needs a detonation, which (once you have the uranium) doesn't require sophisticated machining.


Actually, my understanding is that the tolerances, at least for implosion-type weapons, are extreme and required scientific advances to achieve during the Manhattan Project, not to mention the fact that Uranium and Plutonium are much, much denser than any material that would be encountered at a typical shop.


Ah yes, that was another point in the book. Its took them ages to very slowly and precisely machine the material to a very high tolerance. IIRC, the tools didn't last long at all.


That's a good point, though I am not sure how effective these sort of measures would be against an adversary technologically capable enough to be designing precision nuclear weapons (or against an adversary with enough money to acquire the necessary material).


Not really, but they'd certainly make it easier.

However, high precision CNC machines are useful in a wide range of high-tech applications, and keeping Iran poorer makes the rate at which they can gain power slower. Harder to make smaller or more powerful jet engines, harder to make centrifuges for nuclear enrichment, harder to make more advanced computing fabs - and so on.

If you can make it more expensive for Iran to advance to a particular level, then your investment in your own technologies puts you further ahead when they get there. If you get to cheap anti-ICBM defences first, then the threat of nukes is somewhat neutered, for instance. If you get to jet engines small enough for high performance combat drones first, then the threat of whatever airforce Iran can muster matters less. And so on.

I would imagine that the reasoning behind such embargoes covers more grounds than just whether you can stop someone getting nukes or the like ever and has more to do with balance of power in general.


No, the first functioning nuclear explosives were built in 1945, before the transistor even existed.


CNC machines don't vaporize cities; people with CNC machines vaporize cities.

Or they make submarine propellers or something... you get the idea!


The US exports exactly how many centrifuges to Iran? Or Nukes don't vaporise cities, the man with his finger on the button does?

So, free trade with Iran and let everyone have nice safe nukes, right?

Oddly enough, that would be my position, but for very, very different reasons.


a situation that the manufacturers have turned into a business-opportunity by using the technology to assist in repossessing machines from delinquent lease-payers -- and requiring permission for privilege of deciding where to place their key capital assets.

Yikes. Classic Holdup Problem. There are certainly ways to force inventory checks without GPS software locks; this must have been implemented because of the desire to have actual remote 'kill' capability. What I don't understand is the line of sight issues with (actual) GPS sensors. If the machine is blocked from the birds...like it would typically be indoors...something seems odd.


Information wants to be free. Eventually, everyone who wants to know will know how to build a CNC machine like this, without any interlocks.

If we've given up on growing up as a species, and now believe that humanity's only hope of survival is to limit the spread of information, then we're well and truly doomed. And, sadly, it's probably for the best. After all, who wants to live in a dystopian, nerfed society full of imprisoned intellects? Who wants a bunch of angry apes who're all one bad day from unleashing Armageddon loping around with warp engines and antimatter bombs and black hole generators?

As a side note... reading the commentary on this story is both intriguing and disheartening. The "hacker" mentality that apologizes for, and is comforted by, this sort of manufacturer-imposed limitation on an owned product, this denial of the right to tinker, is a very different mentality than was common when I earned my stripes. Have legally-imposed culture changes like the DMCA really corrupted our community so much? Have constant, overblown reminders of the threat of terrorism rendered us so fearful of each other? Could an individual raised in a community with this mentality ever produce open, populist-enabling technologies, PGP and P2P and DeCSS and modchips? IP itself? Are we still hackers, or are we all just consumers, now?


> A subtly weakened or defective part from a big mill like the NV5000 might find its way into a vehicle or a high-speed machine, with disastrous consequences.

Which is why - at least according to those awesome TV shows - parts in high-end vehicles and machines are checked via precise 3D measuring instruments as part of the quality control process. Just pointing that out. Pretty sure few companies fully trust CNC machines to deliver perfect results all the time.


Yes thats why they have QA/Test departments where do you think the ISO9000 and BS5750 quality standards came from?


This seems incredibly brittle - just like software DRM that needs to phone home. What happens 15 years from now when they shut down their servers?


They don't connect to the company server. They just shut down and display a message to the operator. It's up to the operator to receive an unlock code from the manufacturer. So, there's no server involved. It's all human-to-human interaction.

But again, in 15 years all these codes will be lost by the manufacturer itself, so your main point is valid.


Um, you stop using the machine? The sort of business that is buying these CNC mills isn't going to be interested in using an out-of-support machine (too much risk) and likely depreciates the machine to $0 value in 5-6 years anyways.


There's a legitimate use for GPS spoofing.


Shutting down a competitor's machine shop, for one.


A little earthquake or nearby explosion of some kind and all factory machines shut down. Aaand wait for a code, but first compose a request with all machine numbers.


They're not gong to be receiving GPS signals in the type of room in which these machines are found.


If you did want to stop CNC machines being used in Iran or North Korea, why not just use the GPS chip to disable the machines if they're inside those countries?

I don't see what's to be gained by causing the machines to fail if they've been moved to the other end of a factory.


No GPS inside of a metal box (like a shipping container). You can also spoof GPS since it's a one-way passive signal.


Maybe they'd put the machines in facilities with bad GPS reception?


When the CNC mills from Toshiba made it to the Soviet Union in the 1980's, it had a significant impact on submarine warfare:

http://www.auilr.org/pdf/4/4-1-8.pdf THE TOSHIBA-KONGSBERG INCIDENT (pdf)


Sure, we'll use the embargo clause to explain this. The real reason is that, when you have machines capable of making new machine parts, you want to know when they move around and start building Skynet.


These aren't widgets sold to people on the street. These are very sophisticated buyers of extremely expensive stuff who can afford to pay someone to read the fine print.


Some of the highest precision CNC manufacturing equipment for particular processes is subject to nuclear non-proliferation arms controls as it can be used to make key components in uranium enrichment equipment. So for machines relevant to those laws, a GPS lowjack might be a sensible precaution. North Korea has been picking up this machinery from someone, so I can imagine Japanese industry and government being very paranoid on the issue.


requiring permission for privilege of deciding where to place their key capital assets

Owners should have this right.

I'm interested in the security implications of this

What does gyro sensor lockdown have to do with malware?

the mills are designed to be opaque to their owners

You're not really the owner if somebody can lock you out.

lest they disable the gyro/GPS

Disabling the sensor would probably trigger the lockdown.


Owners should have this right.

Like many things, it depends. If the device is supported by the vendor, and requires very high precision such that jarring it could un-calibrate it, then this is perfectly reasonable, otherwise support costs would become prohibitively expensive for everyone. Why would they care if you've bought it? Because they are protecting their reputation.

Consider the situation of the typical Windows desktop that becomes more and more unusable as the user installs more and more toolbars and other malware. Windows takes the blame for it, but the problem would just go away if it prevented random stuff being installed.


Interesting attack vector ...




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: