This is the provision
https://www.gpo.gov/fdsys/pkg/USCODE-2011-title18/html/USCODE-2011-title18-partI-chap93-sec1924.htm
In short, it is an offence for an officer etc. to knowingly remove classified US info without authorisation with the intent to store or retain it at an unauthorised location.
The fbi crap about they had no intention etc, or ill-will, is just irrelevant imo and the proofs of the offence appear to be present, primarily due to setting up the private server in the first place. The lack of ill-will etc is mitigation, nothing else. Why on earth did such an experienced person even do that? Mystifying.
