Steve, thanks for raising these points - and I've taken them as constructive, as I believe you intended.
TTN is quite challenging to conceptualise, because it only partly fits existing models. On one side, the software stack is (apparently) akin to those in use by mobile telephone operators, with distinct handlers and application on the IP side, and a network sign-on and authentication servers approving devices as they sign on. At the moment, devices use the TheThingsNetwork keys and endpoints, which are both public, and (presumably) just good luck that no two devices have signed on with the same ID. The roadmap shows plans too set up private and segregated networks for LoRaWAN devices.Devices can also encrypt their payload when sending clear metadata over the radio layer, even when sending to the public ThingsNetwork endpoint. There is a footprint a device leaves when connecting, particularly geographically based on which gateways are in range of the transmitting node and their timestamps.
That's broadly how I understand the device identification. Once the message is picked up by a gateway, it's pretty just decrypted with a public key and passed on over an IP transport. Other than data retention requirements, I'm not sure how much the IP bill will affect UK TTN, because the data (as it stands now) is public anyway. Encryption is an optional layer between a device and an online application, via a public message store (currently hosted in The Netherlands). Metadata, including the presented device ID, has to be in the clear to transmit to TTN endpoints. It would be effortless to set up 'stinger' style cells to collect LoRaWAN data, because the spectrum is public.
Your other point about data forwarding over ISPs is an important one, potentially - right now, there's imperceptible level of traffic. But if there's any amount of success to TTN, domestic network providers may be in violation of their ISP's T&Cs - and certainly could be paying communication costs, if maximally saturated estimates of .5gb/d are correct. I can't imagine many ISPs will be happy to be undercut by their customers in the IoT billing space, once they catch up with what's going on.
Do you have any pointers to ECN and PECN definitions and legal obligations in the UK, Steve? Maybe other readers can shed some insight.