You are assuming that this was an insider. If that assumption is false then your #1 is really a witch hunt (as you designated it, though given the rest of your comment I doubt you understand what the term means).
"Really, this is not hard."
Great, thanks for your confidence. You mention Edward Snowden in a comment below to justify this fantasy. An important difference is that in that case they *knew* who had done it. You conveniently overlook the difficulty in conducting this kind of investigation.
Taking as true your assumption that it was an inside job, for your "witch hunt" to be a real investigation with ability to identify the actual culprit there has to be a means of discrimination. One example of how the government routinely fails in this task is their reliance on lie detectors. Everyone working for the NSA has been through it during screening on periodically thereafter. The government loves this absolutely unscientific and thoroughly discredited technique for the simple reason that it gives them the ability to score individuals with pass/fail for clearance. Note that, in general, it is not required to go through a polygraph to obtain a TS clearance -- the various scopes are reserved for particular employment (e.g., FBI, CIA, NSA, etc.). In other words, this is the "step-up" tool that they rely on to improve discrimination before granting access to an individual.
And yet, it fails. Edward Snowden is the currently most famous example, but there are others. If the polygraph had any utility it would have identified the insiders before things blew up. Everyone with a clearance has been investigated during screening, and again periodically. And yet, these investigations failed to stop these individuals. But you have faith that "doing it again" will somehow reveal their identity. Bully for you, but pardon me if I lack such faith.
One of the other difficulties with finding an insider (assuming that such is the case) is how do you know that you aren't tasking the insider with finding himself? When it became obvious that the CIA had a mole leaking the identities of turned agents the investigation was 100% need to know and very few people were in the know. And yet, the target of the investigation was one of those people (head of counterintelligence). Yes, they did catch him. Just because the mole is aware of -- and even running -- the investigation does not preclude identifying him. But it is pretty easy to understand how it complicates things by providing opportunity for framing, surreptitiously destroying evidence, etc. And, considering that case in particular, it was clear from reviewing his file that Aldritch Ames was career managed, but the CIA claimed they found a solitary mole and that imprisoning him ended it. How many other moles did the Soviets successfully implant? Who managed Ames' career?
Without clear knowledge that it was an insider, any internal investigation is very likely to result in what aptly termed a witch hunt rather than a productive investigation. Someone may be identified and it may even be a mole -- related or not to the present incident. But ground knowledge truth is remarkably difficulty to achieve, as is apparent to anyone who has conducted real investigations.
Really, this is hard.