{"id":62784,"date":"2018-08-09T00:00:00","date_gmt":"2018-08-09T00:00:00","guid":{"rendered":"http:\/\/blog.mozilla.org\/foxtail\/2018\/08\/09\/marshall-erwin-trust\/"},"modified":"2021-02-11T22:28:50","modified_gmt":"2021-02-11T22:28:50","slug":"marshall-erwin-trust","status":"publish","type":"post","link":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/","title":{"rendered":"Rapid Fire: Marshall Erwin talks trust and security at Mozilla and Firefox"},"content":{"rendered":"<p>Trust is something you can grasp, but you can\u2019t hold. Trust is as intangible as the pixels, bytes and data that occupy our digital lives, yet it\u2019s core to the health and safety of our online relationships. For the last four years, Marshall Erwin has led trust and security at Mozilla, ensuring that the organization protects the privacy and security of its users and employees through its programs, initiatives and products like Firefox. While those decisions involve a close partnership with our engineering and product teams, the bottom line is that when it comes to actions related to trust and risk at Mozilla, Marshall is always at the table.<\/p>\n<p>I caught up with Marshall about the state of online security, his years working on national security and which gymnastic event was his specialty.<\/p>\n<p style=\"text-align: center;\">~ \u00a0\u00a0~ ~ \u00a0\u00a0~<\/p>\n<p><b>I have to say, you\u2019re the first Director of Trust and Security I\u2019ve ever met. Have you run into other heads of trust?<\/b><br \/>\nYes, a lot of other companies have them. The truth is, trust is a very important concept for Mozilla, but across the industry it is not always a positive term because other companies will use it in a way that is sort of euphemistic. They might say \u201cLook we&#8217;re going to vacuum up all your data, but you can trust us with it. Don&#8217;t worry.\u201d So when you meet someone who is director of trust and security, that might be what they&#8217;re up to. And that is definitely not the approach that we take at Mozilla and Firefox.<\/p>\n<p><b>What does trust mean at Mozilla?<\/b><br \/>\nTrust is a broader concept than security. Trust is essentially the idea that Mozilla has your back. Over time, we have made a set of decisions that not only protect your security on a day-to-day basis but also demonstrate that we are worthy of people\u2019s trust and show that we are a responsible company where you can have trust in our products and want to use them. We have a set of <a href=\"https:\/\/www.mozilla.org\/privacy\/principles\/\">data privacy principles<\/a> to guide us, and you can have trust that if we collect your data we&#8217;re not going to abuse it.<\/p>\n<p><b>I read you have expertise in intelligence and counterterrorism. Can you tell me more about that?<\/b><br \/>\nI spent roughly the first five years of my career in the CIA&#8217;s counterterrorism center. There&#8217;s a unique element to the job in the counterterrorism center where I got to support our operational work, helping to find members of al-Qaeda, for example, and understanding the threats that they posed. At the same time I would get to do things like write briefings for the president or actually brief the president, and do what we would describe as more analytic work. Overall it was an awesome experience. I really enjoyed my time there. It&#8217;s a pretty unique institution that I learned a lot from, where I was able to contribute to our security in a different way that I am today.<\/p>\n<p><b>Which president did you work with?<\/b><br \/>\nMostly President Bush. I left the agency around the time that Obama was coming into office, so a few of my written briefings may have gone to President Obama, but the vast majority went to President Bush. And I once briefed President Bush verbally, which was a really unique and strange experience in the Oval Office.<\/p>\n<p><b>Were you actually in the Oval Office?<\/b><br \/>\nJust once. That briefing went well, but I don\u2019t have a very crisp memory of it because mostly I was in awe that I was in the Oval Office.<\/p>\n<p><b>What are you most excited about at Firefox right now?<\/b><br \/>\nRecently we&#8217;ve been talking about Firefox being a more opinionated browser, and what that&#8217;s going to mean in practice over the next year is releasing a bunch of really important privacy and security features that actively protect people from some of the malicious things that threaten them online. One that we&#8217;ve been public about and started testing last month is our <a href=\"https:\/\/monitor.firefox.com\/\">Firefox Monitor<\/a> service, which will notify people when they&#8217;ve been implicated in a breach.<\/p>\n<p><b>What is one thing you do to protect yourself online?<\/b><b><br \/>\n<\/b>There are plenty of things that we could all do, but the one tip that I tell everyone is to use a password manager. I use a password manager, and I think that overall the internet would be a more secure place if everyone used a password manager. I have my parents who are not technically sophisticated using a password manager, so that\u2019s always my first point of advice.<\/p>\n<p><b>Given your area of expertise, what do consider to be security issue that people should be thinking more about today?<\/b><br \/>\nI&#8217;ll tell you what I&#8217;ve been thinking about over the last year, and especially since the Cambridge Analytica scandal, is that the diversity of companies or parties that you interact with online everyday that are fundamentally not trustworthy but you trust them anyway. When I go online I&#8217;m not a fearful internet browser. I&#8217;m not paranoid, and I don&#8217;t encourage people to be paranoid or fearful when they go on the internet, but I do encourage people to really think and be explicit about what companies and parties they are engaging with and why they think they&#8217;re trustworthy. That is the ecosystem problem we face right now \u2014 that diversity of actors online who maybe you trust but you shouldn\u2019t and if you thought just a little more about why you are trusting them with your data or your security, you might be better off.<\/p>\n<p><b>Security aside, what is digital tool is essential to your daily life?<\/b><br \/>\nPutting security entirely aside, the one thing I consistently use is my podcast app. I listen to national security or technology podcasts for an hour or two every day.<\/p>\n<p><b>What are some favorites?<br \/>\n<\/b>The <a href=\"https:\/\/www.nationalsecuritylawpodcast.com\/\">National Security Law<\/a> podcast or the <a href=\"https:\/\/www.lawfareblog.com\/topic\/lawfare-podcast\">Lawfare<\/a> podcast are two that I listen to regularly.<\/p>\n<p><b>How do you like to disconnect?<\/b><br \/>\nI have two kids \u2014 a three year old and a one year old \u2014 so that\u2019s actually how I spend a lot of my time. But writing would be what I try to do. If I\u2019m really trying to disconnect, I write fiction. Short stories mostly. I have one draft novel sitting in my desk somewhere that I would love to get published at some point. It\u2019s about my time in the counterterrorism center in the mid-2000s.<\/p>\n<p><b>Ok, let\u2019s get to some rapid fire questions. What\u2019s a typical breakfast?<\/b><br \/>\nCoffee.<\/p>\n<p><b>Cats or dogs?<\/b><br \/>\nDogs. I don\u2019t trust a lot of people online, and I don\u2019t trust people with cats.<\/p>\n<p><b>Android or iOS?<\/b><br \/>\niOS.<\/p>\n<p><b>Where do you get your news?<\/b><br \/>\nOnline. The New York Times or Washington Post.<\/p>\n<p><b>Walk, bike or drive?<\/b><br \/>\nWalk, typically, or drive if I really can\u2019t walk.<\/p>\n<p><b>Regarding books, do you go for audio, digital or print?<\/b><br \/>\nTypically print, if I really want to disconnect. I process better with paper.<\/p>\n<p><b>What\u2019s the last internet find you shared with someone?<\/b><br \/>\nI\u2019m not a big social tool person online. Every once in a while I\u2019ll read Twitter and tweet. I\u2019ve never been a Facebook user.<\/p>\n<p><b>When it comes to GIFs, hard or soft G?<\/b><br \/>\nIt\u2019s a hard G.<\/p>\n<p><b>What\u2019s something about yourself that people would be surprised to know?<\/b><br \/>\nI was a competitive gymnast from about age 10 to 25, first in the lower school, middle school and high school, then all the way through college and then a year after college.<\/p>\n<p><b>What was your favorite event?<\/b> It was definitely the rings. I was \u201cthe ring guy\u201d through college. I was OK at the pommel horse, and I was really good at the rings.<\/p>\n<p style=\"text-align: center;\">~ \u00a0\u00a0~\u00a0 ~ \u00a0\u00a0~<\/p>\n<p><i>Marshall is too modest about his gymnastic accomplishments. A three-time national champion of the rings, he also <a href=\"https:\/\/www.youtube.com\/watch?v=kbo3jjs4AW0\">bested Bam Bam the orangutan in a dead hang challenge<\/a>.<\/i><\/p>\n<p style=\"text-align: center;\">~ \u00a0\u00a0~\u00a0 ~ \u00a0\u00a0~<\/p>\n<p><em><span style=\"text-decoration: underline;\">8\/15 update<\/span>: I asked Marshall a late follow-up question:<\/em><\/p>\n<p><strong>Your previous experience with the CIA must raise some eyebrows. Why did you move from an agency that isn&#8217;t known for transparency and openness to working for Mozilla?<\/strong><\/p>\n<p>That&#8217;s a fair question for people to have, although its counter intuitive to me personally because both roles focus on protecting people from the threats that we all face. I understand that people don&#8217;t agree with things the CIA has done. In fact, I don&#8217;t agree with some of the things CIA has done. I think its healthy to work for organizations with which you sometimes disagree. But I&#8217;m proud of the work I did to protect people from al-Qaeda. Today though, the most serious risks we face, as individuals and society, are digital threats.<\/p>\n<p>There are very few organizations as committed and as well positioned as Mozilla to address that risk. That&#8217;s why I work here.<\/p>\n<p>You asked specifically about transparency. Sure, transparency is important at Mozilla. But the key thing to understand is why it is so important for a company like us. Transparency isn&#8217;t just an abstract principle we stand behind. It is the foundation of the trust model we have with our user. You can verify in our code that what we say is true. You don&#8217;t have to take our word for it when we say we are protecting you.<\/p>\n<hr \/>\n<p><img decoding=\"async\" loading=\"lazy\" class=\"alignleft\" src=\"https:\/\/blog.mozilla.org\/berlin\/files\/2017\/10\/firefox-logo.png\" width=\"150\" height=\"155\" align=\"left\" \/><\/p>\n<h2>Firefox. Fast for good.<\/h2>\n<p>Firefox is made by Mozilla, the not-for-profit champions of a healthy internet. Mozilla also tackles issues like privacy, misinformation and trolling by investing in fellowships, campaigns and new technologies designed to make the internet healthier.<\/p>\n<p><strong><a href=\"https:\/\/www.mozilla.org\/firefox\/?utm_source=internet-citizen&#038;utm_medium=blog&#038;utm_campaign=rapidfire&#038;utm_content=marshall-erwin\">Get the new Firefox.<\/a><\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Trust is something you can grasp, but you can\u2019t hold. Trust is as intangible as the pixels, bytes and data that occupy our digital lives, yet it\u2019s core to the health and safety of our online relationships. For the last four years, Marshall Erwin has led trust and security at Mozilla, ensuring that the organization [&hellip;]<\/p>\n","protected":false},"author":727,"featured_media":20884,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[30,289374,464320],"tags":[46036],"coauthors":[],"acf":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Rapid Fire: Marshall Erwin talks trust and security at Mozilla and Firefox<\/title>\n<meta name=\"description\" content=\"When it comes to decisions related to trust at Mozilla and Firefox, Marshall Erwin is always at the table. Here&#039;s his take on online security, working on national security and which gymnastic event was his specialty.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/\",\"url\":\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/\",\"name\":\"Rapid Fire: Marshall Erwin talks trust and security at Mozilla and Firefox\",\"isPartOf\":{\"@id\":\"https:\/\/blog.mozilla.org\/en\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#primaryimage\"},\"image\":{\"@id\":\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#primaryimage\"},\"thumbnailUrl\":\"https:\/\/blog.mozilla.org\/wp-content\/blogs.dir\/278\/files\/2018\/08\/FMB_Blog_Quickfire_Interviews_Marshall.jpg\",\"datePublished\":\"2018-08-09T00:00:00+00:00\",\"dateModified\":\"2021-02-11T22:28:50+00:00\",\"author\":{\"@id\":\"https:\/\/blog.mozilla.org\/en\/#\/schema\/person\/5c987afc4f606be73692d2acfdd1316c\"},\"description\":\"When it comes to decisions related to trust at Mozilla and Firefox, Marshall Erwin is always at the table. Here's his take on online security, working on national security and which gymnastic event was his specialty.\",\"breadcrumb\":{\"@id\":\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#primaryimage\",\"url\":\"https:\/\/blog.mozilla.org\/wp-content\/blogs.dir\/278\/files\/2018\/08\/FMB_Blog_Quickfire_Interviews_Marshall.jpg\",\"contentUrl\":\"https:\/\/blog.mozilla.org\/wp-content\/blogs.dir\/278\/files\/2018\/08\/FMB_Blog_Quickfire_Interviews_Marshall.jpg\",\"width\":1200,\"height\":660},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/blog.mozilla.org\/en\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Rapid Fire: Marshall Erwin talks trust and security at Mozilla and Firefox\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/blog.mozilla.org\/en\/#website\",\"url\":\"https:\/\/blog.mozilla.org\/en\/\",\"name\":\"The Mozilla Blog\",\"description\":\"News and Updates about Mozilla\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/blog.mozilla.org\/en\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/blog.mozilla.org\/en\/#\/schema\/person\/5c987afc4f606be73692d2acfdd1316c\",\"name\":\"M.J. Kelly\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/blog.mozilla.org\/en\/#\/schema\/person\/image\/70718b02fa9f11d88288b937f1da2ac1\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d61ff6a9eb6dd324df20cb773e6c416e?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d61ff6a9eb6dd324df20cb773e6c416e?s=96&d=mm&r=g\",\"caption\":\"M.J. Kelly\"},\"description\":\"Mozilla Communications\",\"url\":\"https:\/\/blog.mozilla.org\/en\/author\/mjkellymozilla-com\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Rapid Fire: Marshall Erwin talks trust and security at Mozilla and Firefox","description":"When it comes to decisions related to trust at Mozilla and Firefox, Marshall Erwin is always at the table. Here's his take on online security, working on national security and which gymnastic event was his specialty.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/","url":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/","name":"Rapid Fire: Marshall Erwin talks trust and security at Mozilla and Firefox","isPartOf":{"@id":"https:\/\/blog.mozilla.org\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#primaryimage"},"image":{"@id":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#primaryimage"},"thumbnailUrl":"https:\/\/blog.mozilla.org\/wp-content\/blogs.dir\/278\/files\/2018\/08\/FMB_Blog_Quickfire_Interviews_Marshall.jpg","datePublished":"2018-08-09T00:00:00+00:00","dateModified":"2021-02-11T22:28:50+00:00","author":{"@id":"https:\/\/blog.mozilla.org\/en\/#\/schema\/person\/5c987afc4f606be73692d2acfdd1316c"},"description":"When it comes to decisions related to trust at Mozilla and Firefox, Marshall Erwin is always at the table. Here's his take on online security, working on national security and which gymnastic event was his specialty.","breadcrumb":{"@id":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#primaryimage","url":"https:\/\/blog.mozilla.org\/wp-content\/blogs.dir\/278\/files\/2018\/08\/FMB_Blog_Quickfire_Interviews_Marshall.jpg","contentUrl":"https:\/\/blog.mozilla.org\/wp-content\/blogs.dir\/278\/files\/2018\/08\/FMB_Blog_Quickfire_Interviews_Marshall.jpg","width":1200,"height":660},{"@type":"BreadcrumbList","@id":"https:\/\/blog.mozilla.org\/en\/firefox\/marshall-erwin-trust\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/blog.mozilla.org\/en\/"},{"@type":"ListItem","position":2,"name":"Rapid Fire: Marshall Erwin talks trust and security at Mozilla and Firefox"}]},{"@type":"WebSite","@id":"https:\/\/blog.mozilla.org\/en\/#website","url":"https:\/\/blog.mozilla.org\/en\/","name":"The Mozilla Blog","description":"News and Updates about Mozilla","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/blog.mozilla.org\/en\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https:\/\/blog.mozilla.org\/en\/#\/schema\/person\/5c987afc4f606be73692d2acfdd1316c","name":"M.J. Kelly","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/blog.mozilla.org\/en\/#\/schema\/person\/image\/70718b02fa9f11d88288b937f1da2ac1","url":"https:\/\/secure.gravatar.com\/avatar\/d61ff6a9eb6dd324df20cb773e6c416e?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d61ff6a9eb6dd324df20cb773e6c416e?s=96&d=mm&r=g","caption":"M.J. Kelly"},"description":"Mozilla Communications","url":"https:\/\/blog.mozilla.org\/en\/author\/mjkellymozilla-com\/"}]}},"_links":{"self":[{"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/posts\/62784"}],"collection":[{"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/users\/727"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/comments?post=62784"}],"version-history":[{"count":0,"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/posts\/62784\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/media\/20884"}],"wp:attachment":[{"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/media?parent=62784"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/categories?post=62784"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/tags?post=62784"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/blog.mozilla.org\/en\/wp-json\/wp\/v2\/coauthors?post=62784"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}