1. Government server - whatever the gov sets up
2. Private server - a service like hotmail or gmail
3. Personal server - something on a box you hire someone to set up for you
We agree that the violation is setting up a non #1 type server, but you are saying it matters if it was #2 or #3?
If that is what you are saying, please elaborate on why you think so. (I don't see that it matters much, but am curious about your argument).
1. Government server - whatever the gov sets up. Chief attribute(s): security
2. Private sector email provider - a service like hotmail or gmail. Chief attribute(s): convenience and security.
3. Personal homebrew server - something on a box you hire someone to set up for you. Chief attribute(s): control and convenience.
A public servant who would use #2 for testing purposes so that they can execute the duties of their jobs is one thing. A public servant who would go to the lengths needed to secure #3, thereby placing their complete archive beyond the reach of the public but well within the reach of intruders, has in my view used their public office for private gain at the potential cost of national security. Their motives and judgment are entirely dubious.
So let me first sort out a number of motives:
1. They may think that a private sector service is puts government documents in private hands which they might consider to be bad.
2. She may not be acquainted with the security differences between the homebrew server and yahoo mail. (I am not. I would assume that a competent technical person with off the shelf software could make it fairly secure.)
I don't know if we must impute nefarious motives from a personal homebrew server.