This is a true story. Some minor details are changed deliberately.
The dame walked into my office, and I put down my scotch with a bang; I’d seen the type before – trouble. She had that worried look that comes across as vulnerability, mixed with enough anger to blow the door off a bank vault. The long bias-cut evening gown was totally out of place for a friday morning at a gumshoe’s office. The door, with its gold leaf logo, “Spade Connector and Short Circuit, Consultants” slammed and she didn’t even jump.
No, that’s not right. Actually, it was a late-night text message, “can I call you?” I always worry when I get those, especially at 3:00am. I used to get a lot of calls at 3:00am.
We talked. It turned out that one of her neighbors had decided that she was a Bad Person and had left a couple of weird letters in her mailbox and her phone would ring sometimes at night. We ran through the threat model to try to assess whether there was real danger, or just annoyance. We concluded there was no real danger – besides, she was moving out of town in a couple of weeks. We got off the phone.
I called her back the next morning. I had gotten a scam-spam email (a Nigerian bank scam) and it gave me an idea. So, we conspired a bit, she gave me the neighbor’s name, and I did some research and for a couple of months after that, whenever I got a scam-spam, I would reply with something mildly surrealistic such as:
Oh! I am very interested in this opportunity! I am, however, being in the middle of a divorce, so I greatly need the capital – your timing is excellent. Since my divorce, I have attorneys that can subpoena my email inbox; it is not a secure communications medium. Please contact me on [+1 XXX-XXX-XXXX] between the hours of midnight and 3:00am eastern standard time when I am home and my wife is usually asleep. When I answer the phone, you can authenticate to me by saying: “Hello are you the creepy guy?” if I say “The swallow flies at midnight” then it is me. Otherwise, the call is being monitored.
I did a variety of replies like that, and sometimes I got replies from the scam-spammers, saying that they had tried to call and wanted to make sure I had given them the right number. So I gave them the neighbor’s cell phone number and said “try me tonight.”
Eventually, my friend was so amused by the whole thing that she began to wonder if it was working – there wasn’t really a good way to tell – so she used a hotel phone to call the former neighbor and see how they were faring. The annoying neighbor immediately began screaming abuse into the phone and hung up.
One of the strategies of cyberinsurgency is to find two things that annoy you, and set them upon each other.
“I always worry when I get those” – by the way, giving good diagnostics is a crucial life skill. When texting something like “can I call you” it’s not a bad idea to give information that prevents the recipient from worrying: “Everything is OK, but can we talk?”