You are assuming these people were just following procedure. This is not accurate. There is at least one case where data was taken and intended to be improperly used at a private company.

These people are more than useful rubes. They actively committed unethical (if not illegal) acts.