Suppose Mugabe sets up a website hosted in Zimbabwe, and then suppose he passes a law stating that it is illegal to access this website from outside Zimbabwe.
Then suppose I happen to access this website - should I be extradited to Zimbabwe because I broke a Zimbabwean law?
For extradition to be possible under the treaty with the US then the crime commited has to be illegal in both countries.
With internet/remote related crime you should always work within the jurisdiction of where the offender is - as they are only required to be aware of the laws of where they are - not the country where the webserver is hosted.
Moot point, the crime was illegal in both countries so he didn't have to be aware of the laws in the US. It is US systems he damaged/hacked so it is the US that wants to prosecute.
Not really seeing a problem with it myself.