It would be wrong to speculate on Sandy Berger's ultimate motive for removing classified documents from the National Archives. Working with insufficient information is the best way to mislead one's self. However, there might be some value to adopting a preliminary framework for understanding new information as it comes to light. The model that comes readily to mind is to regard Berger's escapade as a kind of information countermeasure. The most common ways to conceal information are to 1) create a decoy signal; 2) generate enough noise to blot out the underlying information; and 3) to reduce the signal of the original information which you want to conceal.
Most readers are broadly familiar with the countermeasures used on military aircraft. They can release decoys, like flares or drones. They can emit signals from jamming pods to white out the enemy radar screens. They can employ a variety of measures to reduce their reflection so that they remain unseen, the so-called stealth technology. Each of these corresponds to one type of countermeasure described above. As an exercise one can hypothetically regard the Plame-Wilson affair, the Richard Clarke book and Sandy Berger's bungled theft as representatives of these three kinds of information countermeasures. The first establishes a false "blip" -- the Bush Lied meme -- which misled intelligent bloggers like Oxblog's Patrick Belton for weeks as he followed this phantom echo. The Richard Clarke book can be considered a noise barrager type of countermeasure. It was for the most part a big sound and light show laced with ominous drumrolls with nothing behind it. When the time came to set Clarke's book against Condoleeza Rice's testimony at the 9/11 hearings there was curious lack of collision, as might be expected once you got past the boundary generated by a noise jammer. Berger's attempt to stuff codeword classified documents into his pants and socks looks like signature-reduction exercise on its face. It was an attempt to excise information; to create a stealth object which could pass through unnoticed.
The presence of countermeasures almost always indicates the presence of real information which the jamming is intended to protect. One of the reasons that coverups are so dangerous is they create the danger of "home-on-jam", where the source of jamming signal is itself targeted. The significance of catching Sandy Berger in the act of purloining classified couments is that it enables investigators to "home-on-jam", to find the beneficiary of the coverup. Where will it lead? Stay tuned. Remember that jamming needs to work just long enough for the real bandit to accomplish its mission.