Germany’s response to the July 2026 attack in Berlin illustrates a gap between identifying a terrorism threat and taking effective preventive action, according to an analysis published in the latest issue of the CIC Sentinel, the flagship publication of the Combating Terrorism Center. The study examines how Abdul Ballout, a 21-year-old German citizen who had repeatedly attempted to join the Islamic State, remained at liberty despite a documented history of extremist activity, foreign arrests, criminal convictions and a formal high-risk classification.
On 25 July, at about 10 pm, Ballout drove a Citroën SpaceTourer van onto the Ahornsteig pedestrian path in Berlin’s Tiergarten park during Christopher Street Day (CSD) Pride celebrations. After striking several pedestrians, the vehicle crashed into a tree. The driver reportedly emerged and attacked bystanders with a bladed weapon before fleeing. A 65-year-old Polish woman was killed and 31 other people were injured. Ballout was identified within hours as belonging to Berlin’s Islamist scene. After an intensive 20-hour manhunt, investigators located him at a shed on an allotment garden plot in Berlin-Spandau on 27 July. He allegedly attacked special police officers with a bladed weapon during the raid and was fatally shot.
The investigation found no crime-relevant traces indicating another person had been in the van. However, the absence of evidence for a second perpetrator did not mean Ballout had developed his plans in isolation. According to the analysis, he had maintained contacts with radical Islamist figures and pursued links with jihadists in Mauritania, Lebanon and Syria. His family connections also included Islamic State fighters, one of whom he regarded as a role model.
Ballout, born in Berlin on 2 July 2005, had previously been convicted of assault and robbery as a teenager. In February 2022, a juvenile court ordered him to complete 40 hours of community work. His subsequent attempts to reach Islamic State networks abroad brought him to the attention of foreign authorities. On 16 May 2025, he was detained at Nouakchott airport in Mauritania while reportedly attempting to join the Islamic State’s Sahel branch, known as ISSP. Mauritanian authorities passed information to Germany and deported him via Istanbul.
Despite that intervention, Ballout travelled again from Berlin to Lebanon on 20 May 2025, intending to reach Syria and join the Islamic State, according to the case evidence described in the study. He was arrested in Lebanon on 23 July and sentenced by a military court to three months in prison and a fine of 800,000 Lebanese pounds for incitement to religious and sectarian conflict. He returned to Germany on 17 November 2025 and was arrested on arrival.
German investigators subsequently recovered digital evidence of his continuing commitment to jihadist violence. After his return, he contacted alleged Islamic State members through Telegram, writing, “I want to fight, not just sit around”. Investigators also found more than 100 photographs of his cousin Bilal Omar Bakri, who had been killed fighting for the Islamic State in Iraq in 2015. Ballout had reportedly invoked his cousins’ connections to the organisation when seeking assistance to travel to Syria.
The analysis identifies a series of missed opportunities to restrict his movements. Germany’s Federal Intelligence Service, the BND, intercepted communications indicating his initial plans to join the Islamic State and alerted the Federal Criminal Police Office, the BKA, on 9 May 2025. Yet the German Federal Police did not issue a border search warrant until 28 May, 19 days after the notification. Ballout had already left Germany twice. The study contrasts this delay with the response in Mauritania, where authorities detained him at the airport and returned information to Germany.
A further turning point came on 12 May 2026, when Ballout was sentenced to one year and 10 months in juvenile detention for preparing a serious violent offence endangering the state and disseminating Islamic State propaganda. The court considered him equivalent to a juvenile in moral and intellectual development, partly because he had no vocational training and was living with his mother. It ordered deferred probation, however, and he was released the same day, with participation in a 26-session deradicalisation programme among the conditions imposed.
The Attorney General’s Office appealed, arguing that the sentence was excessively lenient. Ballout remained free for more than 10 weeks, during which he attended only two preliminary evaluation sessions with the Violence Prevention Network. A third session to determine whether he would be accepted into the full programme was scheduled for the Monday after the attack.
The study argues that deradicalisation programmes should complement, rather than replace, measures needed to contain an immediate security threat. It also highlights the decision to reduce physical surveillance despite Ballout’s classification in May 2026 as a highest-risk individual by the Joint Counter-Terrorism Center’s Risk Management Working Group. Although authorities continued limited technical monitoring, the later discovery that Ballout possessed three mobile phones, while only one was known to or monitored by the authorities, exposed weaknesses in the surveillance arrangements.
The attack prompted a policy response. In September 2026, Interior Minister Alexander Dobrindt and Justice Minister Stefanie Hubig presented a 10-point plan to strengthen protection against Islamist terrorism. The proposals included giving greater statutory weight to public security when courts decide on probation and deferred probation, and requiring clearer justification when juvenile law is applied to defendants aged 18 to 20.
Hubig acknowledged the value of deferred probation in appropriate cases but said: “The law must clearly state that a deferred probation may only be ordered if it is justifiable with regard to the public’s security interests.”
