Which should be legal since the US does breach privacy around the world (with the help of his awfully quite home country).

So I don't see the justification to prosecute him. Of course governmental data of the US isn't protected from non-citizen access. Why should it, these are the rules they themselves set. It is naive to think that governmental actors have an advantage at espionage. On the contrary. The most advantages has anyone without critical secrets.