In regards to the proof holding up in a criminal case it is important to understand how complex Bitcoin is. You need to be smart to understand even much of the basics as to how Bitcoin works. I would be surprised if you could explain to a jury (made of up "average" people, most of which likely would not have any technical background) how a pool works or how miners work in enough detail that would allow you to explain the evidence.
I don't think courts usually require a full explanation of the technical details, just expert witness testimony that such and such is fact.
If you were to testify, the defense attorney would ask what you think he did. Your response would be something along the lines of he withheld blocks that he founds while mining on our pool (you would explain what mining, pools are and what with holding blocks mean). The next thing he would ask is "how do you know" you would respond by saying something along the lines of "I looked at our pool records and saw x y and z" The defense attorney would ask to see the records and for you to explain what they mean. Having the records in a presettable format may be the difference between guilty and not guilty or 400 BTC or 0 BTC
Perhaps. But should criminal charges be filed, the prosecutors probably have a budget for discovery, which I presume would include doing this kind of organisation of data.
In regards to should he be paid if he is withholding blocks, if it appears that he withheld three blocks (for example) then 76 BTC (I would be aggressive with TX fees) should be withheld from his payment, at the very least. This is regardless if he was doing this intentionally or not and is especially true for such a large mining farm.
Unfortunately, even after withholding the ~200 BTC, he still owes us like ~400 BTC.
If you could find out his identity with relative certainty you could pursue civil charges against him. Assuming he was not mining via tor finding his identity shouldn't be more difficult then filing a lawsuit against the alias, then sending a subpoena to the ISP, data center until you can connect the dots to his identity.
Yes, but arguably it should be some high-loss miner who would file these charges.
I think wizkid057 is prepared to provide IP addresses to assist in any such lawsuit.