They probably have all kind of activity meta data on all emps but don't actively monitor and only go back and reconstruct in these kinds of events (leaks, IP disputes, emp misconduct, etc.)