Re: This should be covered by a different clause in the contract
The key point here is that it's a civil matter, and should never have been treated as a criminal matter. He was an employee, and he was authorized to have the access he used and to perform the actions he took. What he did was wrong, but does not rise the the minimum level of "criminal". I think he's quite right about that.
That doesn't mean he isn't liable for civil damages for taking actions that were maliciously-motivated and knowingly counter to the interests of his employer. Any employment contract or company policy should have covered those areas, and the standard of proof in a civil matter is "on the balance of probability".
The criminal conviction should go. The $130,000 fine should stay as civil damages.