I've worked on both sides of that, I think you'd be surprised. I also suspect that it's worse at the TLAs and any organization with access to FBI, license plate and various criminal databases. Obviously CCard databases and stuff are off limits as their use is outright fraud, but stuff like traffic cameras, imaging systems, etc.