It is a well known fact that the CIA, NSA, and other U.S. spy agencies work inside the U.S. consulates and embassies abroad under some cover.  Once you know the inner workings, these spies are easy to identify.   

The U.S. government has a classified list called the Security Environment Threat List (SETL), where countries are ranked in 5 categories: political violence, terrorism, crime, human intelligence (HUMINT), and technical intelligence (TECHINT/SIGINT/ELINT/COMINT).  The rankings are given from low, medium, high, and critical. The HUMINT and TECHINT categories are classified, but I will tell you anyway.  All of Russia, China, Hong Kong, Vietnam, Cuba, Venezuela, and North Korea all are ranked high or critical in HUMINT and TECHINT.     In these countries, the U.S. spies take extra precaution.  You will not see them making close friends or having personal relationships with the locals.  They will work on the top floor in the classified area (CAA) of the embassies under the cover of the Information Processing Center (IPC), Management Office, Political & Economics Office, and may even sneak in on a TDY under the Engineering Office.  They tend to keep a low profile and will never want to go out for drinks or anything with the locals.  So if you are a local citizen in these countries and you work at the embassy or consulate and these Americans are always declining your social invites, they may be spies.  Also, they may not have Facebook page or will decline to be your Facebook friend.  Their travel orders will have a slight difference, and there EER annual performance review will be nothing but bullshit fluff because their real EER for their agency (CIA or NSA) will go through another channel.

The best way to "plant a bug" inside the classified area of a U.S. embassy in a critical HUMINT or TECHINT country is to plant the bug on an employee that you can retrieve later.  There is no standard screening method for U.S. employees who have unlimited access to the CAA (blue badges).  Plant a small retrievable recording device that does not emanate any RF signals inside the employee's shoe, wallet, watch, clothing, or even hotel key card.  These items are not scanned, scanning employee's personal items is random (like once a year, if that).  However, if you give the employee a gift, then it will be scanned because it is assumed that the local staff put a bug in that gift.  Then make sure the device records long enough and has enough battery so you can retrieve it a day or two later.  If the employee talked anything classified, you have got it!

Some middle eastern countries like Pakistan, Iran, Syria, and Iraq have high rankings as well in other categories.