> I think IT (and I guess, lawyers)

IT is aware of surveillance. Lawyers have a legal responsibility to take all reasonable steps to safeguard confidential client information. A lawyer misusing a work device is probably roughly equivalent to a healthcare worker doing the same.