>to an insecure server

Email is insecure regardless of who owns the server or where it's located. The government's own position is that emails in transit are postcards, not letters, and emails at rest are abandoned property, not personal papers and effects.

On the scale of how bad this is, plain old email on a private dedicated server is a 10/10, but plain old email on an @state.gov server would have been at least a 9/10. From an "endangering national security" perspective, we should be equally angry about everyone who used the official State email server for classified information.

It's not just information disclosure. Imagine the lulz to be had from the fact that the Security of State can't distinguish between an email from the President and any idiot who knows how to forge a FROM header.

Also, that time when it turned out that the State Department let the Russians have RCE on its email server for more than a year [1].

[1] http://gizmodo.com/state-dept-just-shut-off-part-of-email-sy...

The primary argument would be one of agency - while I agree that it was a terrible thing to have done, if she neither requested nor sent any (additional)* classified information from that system, it lacks the same kind of agency that a person explicitly taking classified data out of a secured location has.

* - additional here meaning that I wouldn't claim it to be deliberate to, say, reply to an email containing classified portions and leaving the classified portions in the reply.