Lauri Love the student accused of hacking into the computer systems of the US missile defence agency, Nasa and the Federal Reserve, has lost his appeal against extradition to America.

Judge Nina Tempia said the 31-year-old, who has Asperger syndrome, could be cared for by “medical facilities in the United States prison estate” and implied that he should answer the “extremely serious charges” in the country where the damage was inflicted.

Love, who lives with his parents in Newmarket, Suffolk, was granted permission to appeal against Friday’s ruling and given bail pending further legal action. The battle over his fate could eventually reach the European court of human rights in Strasbourg and last several years.

There were gasps in the courtroom as Tempia read out her ruling, which followed a full case hearing in June. Love’s supporters, who stormed out of Westminster magistrates court in London shouting “kangaroo court”, fear he could face up to 99 years in a US jail if convicted on all counts.

Delivering her judgment, Tempia said: “Mr Love faces extremely serious charges for offences of computer hacking over a period of one year, from October 2012 to October 2013.

“I accept Mr Love suffers from both physical and mental health issues, but I have found the medical facilities in the United States prison estate, on arrival and during any sentence if he is convicted, available to him, are such that I can be satisfied his needs will be comprehensively met by the US authorities.

“I am satisfied Mr Love’s extradition would be compatible with his convention rights and I send this case to the secretary of state for her decision as to whether or not Mr Love should be extradited.”

The home secretary, Amber Rudd, has until mid-November to consider the case. If and when she decides to authorise Love’s extradition, he will have 14 days to appeal against the ruling.

Love embraced friends and family, who appeared shocked and angered by the decision. “If you have come for justice then you have missed it,” Love told a crowd of press in the courtroom afterwards.

He added that he had not yet read the judgment and would “delay processing it until he was in a safe place”. He added: “It may simply be that this is such an important case that it has to be settled at a higher court.”

His father, the Rev Alexander Love, said: “I don’t criticise the judge. She has just acted on a law that is flawed.

“I always used to believe that to be born in this country was to win the lottery of life. But it’s not fair or just that a boy who has mental health issues should be taken away from his family and support by the US that is determined to exact vengeance on him.

“We have recently had a big debate [in the referendum] about who can come into this country. We need to have one now about who can be taken out.”

Outside the court, Karen Todner, Love’s solicitor, said she was very disappointed by the district judge’s ruling. She pledged to appeal against the decision, initially at the high court and, if necessary, at the supreme court and eventually the European court of human rights in Strasbourg.

“I feel awfully disappointed,” Todner said. “I thought we had done enough. I’m hopeful that the higher courts will consider the human rights issues. This is not the end of the road … I was in and out of courts for 10 years with [the extradition case of the computer hacker] Gary McKinnon.”

At one stage supporters blocked the road outside the court, bringing traffic to a standstill. They played chanted “no love for the US gov” before being moved on by police.

Ahead of Friday’s hearing, Love said he held little hope of justice if he was extradited, and suggested a jail term in the US could cause his health to deteriorate and would lead to a mental breakdown or suicide. The electrical engineering student also suffers from severe eczema and depression.

He and his family want him to face justice in the UK rather than the US, which he said “coerces” people into pleading guilty to get reduced sentences.

The case was considered to be the first substantive test of the “forum bar”, which was introduced by Theresa May when she was home secretary to allow courts to block extradition if it is in the interests of justice to have a person tried in Britain instead. May’s reforms also narrowed any home secretary’s discretion to intervene in such highly charged cases.

Love’s home was initially raided by National Crime Agency officers in October 2013. Asked why it had not prosecuted Love in the UK under the Computer Misuse Act, the National Crime Agency confirmed that it had never sent a full file of evidence on Love to the Crown Prosecution Service.

Sarah Harrison, director of the Courage Foundation, which runs Love’s defence fund and support campaign, said: “This is a very disappointing ruling, not just for Lauri and his family but for everyone who was angry about what happened to Gary McKinnon.

“Clear assurances were given that legal changes would prevent the McKinnon situation from happening again and frankly, if the forum bar can’t help Lauri Love, it’s very difficult to understand how it could ever help anyone. This is not what the public was led to believe at the time and it’s not something we should stand for.”

Bella Sankey, director of policy for Liberty, said: “Where unlawful activity is alleged to have taken place in the UK, those suspected should be tried on UK soil – especially in cases of vulnerable people like Lauri Love.

“Gary McKinnon’s case rightly led to a change in the law which aimed to stop extraditions in cases like this. If that new law cannot be interpreted in a way which does that, the law needs changing again.”

Among the US agencies and firms Love is alleged to have targeted in his cyber-attacks are the US Federal Reserve, US army, US Department of Defense, Missile Defense Agency, Nasa, army corps of engineers, Department of Health and Human Services, US Sentencing Commission, FBI regional computer forensics laboratory, Deltek Inc, Department of Energy and Forte Interactive Inc.

Love, who describes himself as a political activist, is accused of stealing personal information and disseminating it online, causing, according to Tempia’s judgment, “millions of dollars worth of damage”. He has denied exaggerating the severity of his medical condition.