Dear reader,
On 14 August, Spirit Airlines, in Chapter 11 bankruptcy in New York, named Google the winning bidder for its internal records. Google offered $10 million. The back-up bid, $7.5 million, came from Mercor, which supplies AI labs with training data made by experts (auction notice). On 3 September micro1, another AI data company, said it intended to bid $12.5 million (micro1). Google’s lawyers told the court-appointed privacy ombudsman that the data “will be used for the training of artificial intelligence (AI) models” (ombudsman’s report, p. 7). The court has not approved the sale; the hearing is now set for 6 November (notice).
The package held 100 million emails and 500 million Teams items
The asset schedule published in August listed about 100 million emails from 80,000 accounts, 500 million Microsoft Teams items, 17 million OneDrive files and 20.6 million SharePoint items, along with employee records, payroll and 516 source-code repositories (AFA). Before delivery, an independent agent paid by Google is to remove personal details. The sale agreement requires that this de-identification “preserve referential integrity across the data set”, so the links between records survive.
On 9 September Google agreed to drop the passenger booking, refund, onboard purchase, timecard and Wi-Fi datasets, in line with its stated goal “of not purchasing any Consumer Data in the first place” (Google’s response). That removed the airline’s transaction systems. The mailboxes, chats, shared documents and code stayed in.
Three suppliers say their confidential material is in the archive
Spirit’s unions have objected, and on 8 October 121 members of Congress wrote that “no employee-related information should be transferred until appropriate protections are in place” (letter). Three of Spirit’s suppliers have raised a different problem: the archive contains their material, and they say Spirit has no right to sell it.
International Aero Engines, which supplied engines and technical data under confidentiality agreements, says the archive holds its commercial, technical and financial information, some of it belonging to other companies that let IAE share it with customers only in confidence (IAE). Navitaire, Spirit’s reservation-software vendor for 19 years, quotes a clause allowing Spirit to use its information “only in furtherance of the transactions contemplated by this Agreement” (Navitaire and Amadeus). Both want their material removed before the transfer, or the transfer blocked.
Springshot, whose software coordinates aircraft turnarounds, says its data reached Spirit through email, Teams and SharePoint. According to Springshot, Spirit first said it did not believe Springshot’s data was in the package, then agreed to exclude some of it (Springshot, 9 October). These are one side’s statements, and the court has made no finding. Removing names, which is the de-identification agent’s job, does not remove an engine maker’s pricing or a software vendor’s operating data.
Closed start-ups are selling the same kind of archive
Smaller archives are already being sold. In April, Forbes reported that cielo24, a captioning company, sold 13 years of Slack messages, Jira tickets, email and Google Drive files as AI training data while winding down, for “hundreds of thousands of dollars”. The sale went through SimpleClosure, a firm that winds down start-ups; its chief executive said it had handled nearly 100 such deals in a year, typically paying $10,000 to $100,000 per company. A competitor, Sunset, prices archives partly on “data richness”: a Jira ticket tied to a specific code commit is worth more than a standalone document (Forbes). Turing, which supplies data to AI labs, says it buys defunct start-ups’ code repositories, design documents and internal wikis (Turing). On 9 October micro1 committed to spend $1 billion over 12 months “acquiring and licensing enterprise operational data” (micro1).
Sunset’s pricing shows why a supplier’s material is hard to separate out: buyers pay for the links between records, the same links Spirit’s sale agreement requires de-identification to preserve. Spirit’s suppliers could object because a Chapter 11 sale is announced publicly, with a deadline for objections. A start-up wound down out of court has no such step.
A company’s secrets also sit in its partners’ archives
Suppliers’ and customers’ confidential material travels in ordinary email and shared folders: price lists, technical drawings, contract drafts, incident reports. The clauses in Spirit’s case limit how the holder may use it or pass it on. Spirit’s case shows what happens when the holder fails and the archive itself has a buyer.
In my view, a confidentiality clause protects a company’s material only as well as the firm holding the copy knows what is in its archive. A Polish bank’s architecture documents and a manufacturer’s price lists sit in the mailboxes and SharePoint sites of their integrators, consultants, law firms and software vendors. Springshot had to notice the sale, file in a US court and argue over where in Spirit’s archive its data was.
In the EU, the two halves of Spirit’s archive would be treated differently. The employees’ emails are personal data, so GDPR would apply to every name in them, and a sale does not by itself give the buyer a lawful basis to use them for AI training. Germany’s data protection authorities say that in an asset sale without a transfer of the business, passing on employee data will normally need the employees’ voluntary consent (DSK, 11 September 2024, section IV). A supplier’s prices or technical data are mostly not personal data. They rest on the contract and on trade-secret law. The EU Trade Secrets Directive treats as unlawful the use or disclosure of a trade secret by someone who breaches a confidentiality agreement or a contractual limit on its use, and it also covers a recipient who knew, or ought to have known, where the information came from (Directive 2016/943, Art. 4). In Poland the same rules are in art. 11 of the unfair competition act, and they protect only information that is kept secret, has commercial value for that reason and was protected by reasonable steps. Polish bankruptcy law lets the trustee sell the business or single assets, and does not say how a supplier’s confidentiality agreement applies to such a sale. A company whose material sits in a failed partner’s archive has to bring the claim itself, as Springshot, IAE and Navitaire are doing in New York.
For banks and insurers, DORA covers part of this. It requires their contracts with ICT providers to ensure “access, recovery and return” of the financial firm’s data “in the event of the insolvency, resolution or discontinuation of the business operations of the ICT third-party service provider” (DORA, Art. 30(2)(d)). The article is about data held in the provider’s systems. It says nothing about the copies a provider keeps in its own email and chats, or about what an insolvent provider’s estate may sell.
The clauses also bind the holder while it is solvent. Navitaire’s, for one, limits Spirit’s use of its information to the transactions under the agreement, which is a question for any company that wants to build a training set from its own email, or sell one to a buyer such as micro1.
Briefing
On 12 October, the European Commission published an account of a special meeting of the AI Scientific Panel on recent incidents in which AI systems acted outside their developers’ control. It says “the AI Office has already requested and received serious incident reports” and has asked developers about their security practices (European Commission). The Commission names no developer and announces no penalty. The page confirms that the AI Office is already collecting serious-incident reports.
On 15 October, Reuters reported that some investors in Anthropic’s planned IPO had discussed a valuation of about $1.5 trillion, down from earlier expectations of around $2 trillion. According to Reuters, Anthropic told prospective investors that its third-quarter revenue was $16.8 billion, up 45% on the previous quarter (Reuters via MarketScreener). Annualised, that is $67.2 billion, so the two valuations equal about 22 and 30 times revenue. For a firm choosing a model supplier, the figures describe a supplier that is growing quickly, and some of its prospective investors want a lower price for it.
On 13 October, the three European Supervisory Authorities for banking, insurance and securities published their joint work programme for 2027. It continues the DORA oversight of critical ICT providers and states: “In 2027, special focus will be given to Artificial Intelligence (AI) and tokenisation” (ESAs, JC 2026 21, paragraph 17). The programme sets supervisory priorities and does not create new rules.
Summary
Google bid $10 million for Spirit Airlines’ email, Teams, documents and code, to train AI models. Three suppliers, International Aero Engines, Navitaire and Springshot, say the archive contains their confidential material and that Spirit cannot sell it. The court hears the case on 6 November. Closed start-ups are already selling smaller archives of the same kind, typically for $10,000 to $100,000 each.
Last week’s issue was about a client’s code leaving through its suppliers’ AI agents. Spirit’s case shows a company’s material leaving through a partner’s insolvency. In my view, what matters is which partners hold a company’s material and whether they could find it if asked. When a partner fails, its archive can now find a buyer, as Spirit’s did.
Stay balanced, Krzysztof
Krzysztof Goworek is founder of Quintant — AI advisory that gets enterprises from experiment to production value.