Most people, I think, don’t follow strict digital security/hygiene policies, nor understand them. That includes me, even though I try to be good. (I will not give specific details because two of my three memorable errors are currently covered by NDAs, and the third is personal).
Right, but they don't need to investigate most people. They need to investigate people who are motivated enough to... well, I'm not sure what. Cross borders while possessing illegal data? But anyway, the people who are motivated enough to do it can easily circumvent it. The only people harmed are innocents.
“Need” for what end? If there is political will to be “tough on crime”, or to reduce immigration and get away with it by saying you’re really only being tough on crime, you can probably find something on anyone simply because laws are too broad. Likewise if you care about performing economic espionage, you don’t need to worry that you’re mostly getting low-hanging fruit.
These are checks you can perform on everyone, after all.
