So, let's just put it clearly: suppose someone who is, at the time, not physically present in the US, breaks into a computer system which is physically present in the US at that time. Which of the following do you think most accurately describes the situation?

1. No crime has been committed, because these actions took place on the internet, where no laws apply and no country has jurisdiction.

2. A crime may have been committed, but only if breaking into computer systems is against the law of the country the person was in at the time, and so only that country could prosecute.

3. A crime was committed in the United States, but the United States cannot prosecute someone for a crime if some element of that crime took place physically outside the borders of the United States.

4. A crime was committed in the United States, and the United States can prosecute the person responsible, and has the power either to arrest that person if they happen to visit the US voluntarily, or to extradite that person from the country they're in if an extradition treaty exists between the United States and that country.

The accepted view, for the record, is (4), and appears to be the basis of this case: the indictment claims computers physically located in the US were affected, which gives the US jurisdiction to arrest and prosecute.