singlemode fiber splitters come in various ratios of light passed to light split off to your own thing. You fusion splice it in place. It's basically just a prism in a box. If you want to tap a circuit such as between two datacenters at the most fundamental (OSI layer 1) level, before the dark fiber is ever handed off to the customer, you would put in place a tap that passes 90% of the light and keeps 10% of it, splits it off, then feed that into your own local amplifier if needed before passing the tap to your interception/storage equipment, if the received signal level from the 10% is too low.
the general principle is actually not much different from some things you do in ordinary DWDM system engineering (where you want to give an analysis port to a spectrum analyzer) or the various types of splitters that exist for GPON network builds.
there are also lots of ways to hand-wave away the loss from a tap to a carrier customer, like "oh yeah there's some dirty patch panels over there" or "that segment of fiber was fusion spliced in an emergency repair at 3am eight years ago after it got taken out by a truck, there may be some slightly higher loss on some strands". And even more so for an inter-city fiber link that's way under 80 km (more like 30-40km, tops), where the optical link budget POP-to-POP isn't in question, and well within the reach of ordinary optics even when considering old or dirty fiber in between. The ISP customers might not look too hard at it.
google "fiber plc splitter" for some manufacturer info and datasheets.
I'm curious, how does one "do it right"? Is there a technical explainer somewhere on how this works (in theory)?