I think the bigger issue (which another article I read on this last week described, but I sadly can't find it right now) is that low punishment for when it's caught means its more likely to happen and not be caught. There were 3 cases reported in 2015, how many went unreported? If the culture is "oh it's fine, just don't be egregious about it" I expect it's happened a lot more than 3 times in the last year.<p>Do they not maintain proper audit logs? I work for Stack Overflow and I can't look at a user's PII without it being logged in multiple systems, do we have higher internal security than the police department?