In the US I'm pretty sure it's legal at the federal level because the network is actively advertising itself by broadcasting the SSID and no user name or password is required when connecting.

AFAIK, violating the CFAA would involve actively circumventing a mechanism intended to restrict access.