American fraudster Mikhy Farrera-Brochez was found guilty of all three charges against him relating to stolen identification documents from Singapore by a jury in Kentucky on Tuesday.
The verdict at the end of a 1½-day trial means he is likely to get a jail term of between 18 and 24 months, said his lawyer Adele Burt Brown.
Farrera-Brochez, 34, was convicted of intent to extort from the Singapore Government in two e-mails sent on Jan 22 and Feb 18 this year.
In these, he threatened to further disseminate the Singapore HIV Registry data in his possession if his husband was not released from jail and other demands were not met.
He was also convicted of unlawfully and knowingly possessing the HIV database, which contained the personal identification details of more than 14,000 people, with the intent to violate US federal law.
His lawyer argued that he did not intend to extort from the Government, but wanted to make people aware that the database had been breached. While he acknowledged leaking the database early this year, he said he was not behind its initial leak in 2016.
"He wanted to get the Singapore Government to acknowledge that the data had not been kept secure," said Ms Brown, adding that he had approached several officials in Singapore and the US about the registry but was rebuffed.
Farrera-Brochez told the court that he also sent the two e-mails because he wanted Singapore to shut down the registry, which he said discriminated against gay individuals.
"You don't need to register them for scientific and health purposes," he said, referring to Ministry of Health (MOH) communicable diseases director Vernon Lee's testimony on Monday that the registry collected personal data of patients to understand the spread of the virus and target education efforts.
"You can collect their data anonymously. You don't need their names to know their sexual practices," Farrera-Brochez said.
He also said that he suffered from post-traumatic stress disorder from being beaten and gang-raped in jail in Singapore from 2016 to last year.
"I'm a bit erratic, I can't deny that even on my best days," said Farrera-Brochez, who told the court that he was lonely and missed his cats.
The Singapore Police Force and Singapore Prison Service said in February that his claims about being abused while in custody were "baseless allegations".
Ms Brown said: "He did not mean to extort. He meant... to get Singapore to acknowledge that it had allowed a database."
US prosecutors disagreed and noted that there were inconsistencies in his statements to the US court and to the Singapore authorities.
Farrera-Brochez also admitted under cross-examination that he faked credentials to get hired at Singapore polytechnics and did not have a degree in special education.
US prosecutor Dmitriy Slavin said in his closing argument: "When you have an issue with something a government has done, there is a right way and a wrong way to go about doing it... Mikhy Farrera-Brochez chose extortion.
"He chose to use the private medical information of thousands of people, who had nothing to do with anything, as his bargaining chip."
Farrera-Brochez, who did not respond while the verdict was read, was remanded and will be sentenced on Sept 27. He faces a maximum jail term of nine years and a fine of US$750,000 (S$1.02 million) for all three charges in total.
MOH also has a civil suit ongoing in Kentucky to compel him to delete and return the stolen HIV Registry data.