The Department of State, to include Hillary Clinton as the Secretary of State, does have Originator Classification Authority. This means she carried the authority to control the level at which material generated by the Department of State is classified, within the boundaries of applicable doctrine. There is some material that must be classified as a matter of course, to include correspondence with Foreign Governments, controlled schedules, and information garnered from classified material.
However, there was information contained within her emails that had been classified by government agencies outside of the Department of State, beyond the scope of her OCA. Among her emails on the 'private server' were satellite imagery of foreign countries, classified by the intelligence agencies. These images are controlled as Top Secret, Special Compartmentalized Information, Talent Keyhole, but were located on her personal email server and mislabeled as unclassified. These items should never have been present on an unclassified, or general use, information system. The Government uses specially developed cyber enclaves to protect this data, segregating it from everything else. In order for these pictures to exist on an unclassified system, someone illegally copied them from a system cleared Top Secret information, crossed the physical air gap to a general use computer, and then emailed them to her. The situation is further complicated by the use of the personal server; if these communications had been made via a Government Information system, there would be a firm management and accounting of the emails. This would have satisfied the requirements of the Federal Records Act. By operating on via a personal server, she bypassed the established mechanisms for information assurance and accounting.
At (5 July 2016), per the FBI investigation report, there are 110 emails over 81 email chains that contained classified material controlled by an agency other than the State Department. Of those 52 email chains, 8 were Top Secret, 36 were Secret, and 8 were Confidential. This includes an email using portion markings for the paragraphs, reported by Fox News 10 June 2016. Additionally, about 2,000 were up-classified to Confidential by the Department of State, demonstrating that classified material was being improperly transmitted via an unclassified network. This only accounts for the emails that have been surveyed; the contents of the estimated 32,000 she deleted can't be verified. That the material had to be classified after the fact is immaterial; it contained information that by doctrine should have been properly controlled and segregated from the general service information system. This is why the talking point used by Hillary Clinton shifted from "no classified material" to "no material that was marked classified". It was indefensible for her to continue claiming there wasn't classified material on the email server, after a preponderance of emails had to be classified because of the material they contained.
The FBI investigation report reveals that Hillary Clinton's lawyers were not reading the emails individually when they deleted them from the private server. Instead, the just deleted emails according to their header information and through the use of search terms. This is used as an explanation for why work related emails produced by Hillary Clinton found in other inboxes or accounts were not among those that she turned over to the State Department; while there is no evidence it was intentional, these emails were deleted during the review. Had Hillary Clinton operated her email via a government ran server, existing mechanism would have assured the emails were properly archived.
Individuals that are determined eligible to handle classified material, and granted access to that classified material, are trained on the control of material that is classified and the recognition of material that should be classified. Since she has been in the government service for decades, she should have an understanding of how classified information is controlled. There is a tight, doctrine driven, process for evaluating people that will have access to classified material, instructing them on its care, and training them on how to recognize material that should be classified. The proper response to seeing these images on her personal, non-government, email system would be to call away a spillage. This would put cyber security and information assurance individuals into motion to track down how the information crossed the air gap, which computers it had touched, and commence the confiscation of those computers.
Separate from the FBI Investigation report from 5 July 2016, the FBI released their interview and investigation notes on 02 September 2016. These documents describe that there were 81 e-mail chains which the FBI determined were transmitted and stored on Clinton's unclassified server, ranging from confidential to Top Secret, Special Access Program, at the time they were sent between 2009 and 2013. Additionally, the US Department of State, in connection with a Freedom of Information Act, identified 2000 emails that were Confidential and 1 that is Secret. Of those 81 email chains, containing classified material at the time they were sent, 8 were TOP SECRET, 37 SECRET, and 36 CONFIDENTIAL. Of that, 7 were Special Access Programs, 3 were Special Compartmented Information. Further, of the 81 email chains, 36 were Not releasable to Foreign Governments (NOFORN) and 2 were releasable only to Five Eye Partners.
Why intent does not matter.
Through out his statements on the issue, and in the many discussions that followed, the focus has shifted to a lack of evidence for "intent" to mishandle classified information. This confuses the issue, because intent isn't required. US Code Title 18, Section 793, Subsection (F), quoted below in its entirety, doesn't stipulate that intent must be demonstrated.
(f) Whoever, being entrusted with or having lawful possession or control of any document, writing, code book, signal book, sketch, photograph, photographic negative, blueprint, plan, map, model, instrument, appliance, note, or information, relating to the national defense, (1) through gross negligence permits the same to be removed from its proper place of custody or delivered to anyone in violation of his trust, or to be lost, stolen, abstracted, or destroyed, or (2) having knowledge that the same has been illegally removed from its proper place of custody or delivered to anyone in violation of its trust, or lost, or stolen, abstracted, or destroyed, and fails to make prompt report of such loss, theft, abstraction, or destruction to his superior officer—
Shall be fined under this title or imprisoned not more than ten years, or both.
Focusing specifically on the satellite imagery that existed in her emails, this alone constitutes a violation of 793, since it is a photograph moved from its proper place of custody.