Yes. The US federal government has voluntarily relinquished their sovereign immunity and they can and often do get sued for copyright violations. Of course, given that the NSA/CIA have the luxury of classification, the resulting lawsuit will be even more complicated than a normal copyright lawsuit (which is already one of the most expensive and frustrating parts of law to litigate).

States are where you need to worry. Occasionally a state decides to pass a law[0] saying they can't be sued for certain copyright violations. Because of how the US constitution is set up, states (and nothing smaller than them) are allowed to just say they can't be sued, which lets them crime with impunity.

[0] https://www.npr.org/2020/03/24/820381016/in-blackbeard-pirat...

Anyone can make open source code changes and be license compliant as long as you don't release the binary (YMMV depending on specific license). However as soon as you give someone binaries they're entitled to request the source. I'd love to see a future with goofy situations like Iran suing for the stuxnet source code because it statically linked a GPL library.

Might depend on whether copyright applies to the agencies, since the GPL depends on copyright itself.

GPL only requires you to provide source code when you provide an executable program. If their internal software isn't released outside the organization, then source code does not need to be either.

When government agencies behave within the law, it is by coincidence, if not an accident which will soon be rectified.