> An employees actions would be a matter of judgment between the company leadership and themselves
There has been a few news articles (and court cases) where this question has been raised and it is not strict true. Employee actions are only actions for which the employee has been given as an task as part of their employment and role. Actions outside of that is private actions. When this end up in court, the role description and employee contract becomes very important.
A clear case example is when a doctor is looking up data on a patient. Downloading patient records from people who they are not the doctor for can be criminal and not just a breech of hospital policy, especially if they sell or transfer the data.
I was tempted to add this very line when I wrote my message but I hoped it would be obvious I don't mean things like illegally stealing private data. I was talking about things like "falsifying" data to the contractor, which doesn't seem like a crime to me just a contract violation.
If the employee are destroying property owned by the employer, for which is not part of the employee role or assignment, then they could be charged with hacking and property destruction just as if it was done by someone outside the company. The way around this that some people can attempt is work-to-rule strike. That would be a legal way to sabotage a contract without actually going beyond that of the employee contract.
Again I was thinking of things like submitting non-functional application or data, not obvious property crimes like destruction of property.