Access to sensitive data is strictly controlled, logged and audited, often on a per-case basis ("I need read access to log X for 60 minutes to investigate bug Y

Access to sensitive data is strictly controlled, logged and audited, often on a per-case basis ("I need read access to log X for 60 minutes to investigate bug Y"). Even if your hypothetical spy did manage to worm their way into the very, very select ranks of people who can access (say) Gmail data, he'd be busted as soon as the auditors spotted him accessing the files of people he has no reason to access.