OSINT teams buy databases on darkweb to do investigations too. Agencies can be punched in court for obtaining an information that shouldn't be availiable to them and paying criminals as it's not up to legal standards, like tapping the phone without an order. But real criminals are data miners and thieves. And in some cases, weirdly enough, it's still legal to do that.