Andrew Ferguson is a disturbed young man. Brilliant, but disturbed. Funny and innovative. But disturbed.

You know the email spam you get that says, please call this bloke in Africa to send him money to (fill in the appeal here) in the wake of (insert natural or national disaster)? Well Andrew decided to call. Using SkypeOut. Interminably. At odd hours. Tying up the con-man's phone line.

Aside from the dark pleasure of petty revenge, what's going on here?

Skype's design favors offensive tactics

First, there's an imbalance in our cost of calling. As a Westerner, he can afford 10 Euros for 10 hours of calls. If he buys more, the rate falls even further. As a percent of disposable income, this is small potatoes to Andrew.

Second, there's an asymmetry in the opportunity cost of tying up the spammer's phone line. Others aren't getting through to the spammer, so every hour the line is tied up is a sucker missed and money foregone.

Third, Skype calls can be automated. So you can program a thorough barrage of short calls scattered throughout the day. And night. This optimizes your use of your SkypeOut minutes since there is not per-call charge, just a charge for the time. It also exploits the spammer's need to answer each time the phone rings or never talk to another sucker. So every call both increases the effort needed to capture a sucker, since for each sucker there are dozens or hundreds or thousands of fake calls. With little effort (one programmer coded this in 20 minutes) you can make it pointless for a spammer to keep a given number.

Take this a step further: decentralize. Create a spam filter that looks for, say, new Nigerian phone numbers in your email spam bin. Automatically grab them, and post to a listserve, sharing targets. Then have your Skype run the attacks against multiple targets, randomly selected by you and others. This decentralizes the work, aggregates your SkypeOut minutes, buying power, and exposure (if someone tries to find out who you are) among many Skypers. Putting the Power of Many to use.

This is a hoot.

Until the number being attacked is a fire department, or a hospital, or your home. Or air traffic control, or a credit card processing center. Or your mobile phone, where you have to pay high rates for every call, even one lasting just a few seconds.

What can you do about a telephonic denial of service attack?

Other than changing your number?

Maybe we can adapt defenses against flooding attacks in other media, like email and DNS. Maybe not; much of the information used on the Internet isn't available with POTS.

Can you detect an attack building up?

How about a distributed DOS attack?

Who would you call for help?

After the fact, which laws would apply? When would Skype cooperate with law enforcement or civil litigators to provide SkypeOut logs connecting calls to SkypeOut user accounts? Would Skype provide billing data?

And could we blame it on Andrew? Or his Doctor from Nigeria?