Under 18 U.S. Code 1924. She also violated several portions of the CFR, which generally wouldn't carry a possibility of prison, but would justify fines and loss of security clearance.
OK, so here's the cited USC, with undefined portions highlighted:
(a) Whoever, being an officer, employee, contractor, or consultant of the United States, and, by virtue of his office, employment, position, or contract, becomes possessed of documents or materials containing classified information of the United States, knowingly removes such documents or materials without authority and with the intent to retain such documents or materials at an unauthorized location shall be fined under this title or imprisoned for not more than one year, or both.
(c) In this section, the term âoeclassified information of the United Statesâ means information originated, owned, or possessed by the United States Government concerning the national defense or foreign relations of the United States that has been determined pursuant to law or Executive order to require protection against unauthorized disclosure in the interests of national security.
The passive voice tends to hide the fact that "has been classified" dodges the question of whose authority (Congress, the President, the Director of the CIA, the Director of the NSA, the Secretary of the Interior, the head of the Forest Service etc.) did the classification. However, it's patently silly to give a low-level clerk the power to render the President of the United States in violation of the law so there has to be more than passive voice involved somehow.
So, for instance, how do the highlighted "authorizations" and "determinations" happen?