Ah, you wanted a Secure National Agency :-)

I'm sure they do have elaborate security procedures but the size and scope of the organization means that any operational issue (including security) is almost always Someone Else's Problem. And since the NSA's purview is basically ELINT + crypto, they don't have the same sensitivity to more traditional espionage methods that a HUMINT organization like the CIA does.

Incidentally I'm thinking of setting up an OSINT entity if you're interested.