Do you have a reference for actual detected spies at Google? Of course it would be valuable to have them there. Google has lots of systems to keep track of what information you access thought, from when I was there. IE if you say want to look at PII like real user names for some debugging reason, you had to go through a portal that was along the lines of declaring: "I need to access this internal system that has PII, here is my authenticated request with my name on it". And when I was there, they would follow up and ask me about it. This was on a database product.

On the other hand, there were multiple stories about the guy from Saudi Arabia who was at twitter and I think he got away back to S.A.