This leaves the door open for any HTTPS Website (rogue or otherwise) to match the UID to a Real IP address or E-mail account, with or without the help of Javascript.

The use of Javascript could also lead in some cases to the Computer Users Account name being discovered!

How can this be called an advancement in Privacy as the ISP’s are trying to claim.

Here’s a silly example (because you’d be mad to implement something this way; you should be using HTTPS; and I have wildly exaggerated the possible consequences). Let’s say I run a charity web site, my 20th cookie holds the currency for a donation via bank transfer. The Phorm cookie is added without my knowledge, which means that the IE6 browser (limited to 20 cookies per domain) drops the currency cookie (now cookie 21). My web site happily transfers 50,000 pounds to Save the White Whale instead of 50,000 pesetas. The customer is bankrupted by hideously unfair overdraft charges but Ahab is confounded once more.

Who should the customer sue?

P.S.
You could presumably disable the Phorm cookie by adjusting the JavaScript to delete the webwise cookie if it finds it. Phorm would do it’s infinite loop detection and blacklist the web site. I didn’t want to include code for that in case my ISP took umbrage and disconnected me.

I may be missing something, but I now figure that, as a website developer, if I set a cookie on all my domains with the name “webwise” and the value “OPTED_OUT” then pages in these domains will not be diverted/profiled, even if a person is visiting them via a phormed ISP.

I got this from paragraph 28 of your document. If my interpretation is wrong, please add a comment to let me (and others) know - many thanks.

More complex (and very Phorm-specific) disruption would involve changing the content of Phorm’s cookies (the ones in your website’s domain). However, until there is an operational trial, you cannot be sure what the deployed technology will exactly be.

function hasPhormCookie()
{
var found = false;
var c = document.cookie
if (c.length>0)
{
// If phorm change the name of the cookie they insert
// you need to change the comparison string to match
if (c.indexOf(”webwise=”, 0)>-1)
{
found=true;
}
}
}

if (hasPhormCookie()==true)
{
document.write(”Phorm is monitoring your traffic”);
}