Stealing a bar of chocolate from a website is also not a federal crime.

Yes it is because it is interstate commerce. Even if you are located in the same building as the server, just being connected to the internet raises the potential for it to be interstate commerce so it falls into the federal domain.

18 USC 1030(a)(4): (a) Whoever— ... 4. knowingly and with intent to defraud, accesses a protected computer without authorization, or exceeds authorized access, and by means of such conduct furthers the intended fraud and obtains anything of value ...

A "protected computer" has a specific definition, and "a website" doesn't necessarily meet it.

tptacek knows the CFAA pretty well for a non-lawyer. It doesn't mean he's always right, but you should be careful if you're trying to trip him up.

I think he might be right.

"Protected computer" is an incredibly broad term that covers almost any modern computer or device:

(2) the term “protected computer” means a computer— ... (B) which is used in or affecting interstate or foreign commerce or communication, including a computer located outside the United States that is used in a manner that affects interstate or foreign commerce or communication of the United States;

I can't imagine they'd ever prosecute anything below the $5,000 mark but even a candy bar sized loss does appear to fall into the federal domain. (Not saying I agree with it, but that's how the interstate commerce clause has been applied in almost every case.)

Actually, it may well be. Depends on where you are, where the website is hosted, and whether any of the fiber(etc) your packets traverse cross state lines...

No, stealing a candy bar across state lines is also not a crime under the CFAA.

(Wait, it might be. I misremembered what the dollar minimum in the CFAA applied to --- the dollar limit is why you can't be charged under the CFAA for stealing airplane wifi, but things of value other than computer service itself have no dollar minimum I can find.)

Anyways, don't steal candy bars.