Germany’s security agencies already knew Abdul Ballout. The 21-year-old was considered radicalized and willing to use violence, had allegedly planned an attack before and had been convicted of Islamist offenses. Yet he was still able to strike at Berlin’s Christopher Street Day.
The attack killed one woman and injured numerous others. Ballout later died during a police operation.
The Federal Public Prosecutor General has taken over the investigation. According to media reports, Ballout had been placed under surveillance for a time and his phone had been monitored. He had also been ordered to take part in a deradicalization program.
His case illustrates what lies behind the figures published by Germany’s domestic intelligence agency. According to official data, 28,645 people nationwide are currently classified as belonging to the Islamist spectrum. Of these, 9,110 are considered violence-oriented. The category includes people who commit violence themselves, are prepared to do so or explicitly endorse it.
Around 450 Islamists were most recently classified as “Gefährder”, a police term for individuals considered capable of committing serious politically motivated crimes, including terrorist attacks. The designation is based on an individual threat assessment conducted by the security authorities in each case. Those classified are generally men.
More Than 900 Violence-Oriented Islamists in Berlin
The problem is particularly acute in the capital. In 2025, Berlin’s domestic intelligence agency identified 2,590 people as belonging to the Islamist scene. More than 900 of them are considered violence-oriented.
The Salafist scene comprised around 1,250 people, including approximately 350 classified as violence-oriented. There are also around 200 supporters of the Palestinian terrorist organization Hamas and approximately 300 supporters of the Lebanese terrorist organization Hezbollah.
These groups form the environment from which new attackers, accomplices and recruiters can emerge. The security authorities therefore monitor Islamist associations, extremist preachers, backstreet mosques, personal contacts and digital networks.
When specific indications emerge, the information is passed to the police and public prosecutors. The authorities simply do not have enough personnel to monitor every high-risk individual around the clock.
Continuous surveillance requires several teams working in shifts, with at least six officers assigned to each person under observation. It also involves technical analysis and coordination between different authorities. The security services therefore prioritize cases according to the level of danger they believe each person poses. Being classified as a Gefährder does not mean that the individual is under constant surveillance.
Lone actors who neither meet nor communicate with others are particularly difficult to monitor. Telephone surveillance captures only communications that actually take place.
Someone who does not disclose his plans, uses new devices or turns an everyday object such as a car into a weapon can strike suddenly and unexpectedly even while under official scrutiny.
Ballout’s case therefore raises questions about how the authorities most recently assessed the risk he posed after his release from custody, particularly in light of his earlier attack plans and the failure of deradicalization measures. The authorities had enough evidence to continue classifying him as a threat. Yet the available resources were apparently insufficient to keep him under permanent surveillance.
The courts and expert assessors involved are now also facing criticism over the decision to impose a suspended sentence rather than a prison term.
174 Investigations into Terrorist Offenses
Germany is currently debating which form of political extremism poses the greatest threat. The cases being handled by the Federal Public Prosecutor General provide a clear answer.
In the first half of 2026, federal prosecutors opened 174 investigations into terrorist or extremist offenses. Of these, 129 involved Islamist terrorism. That represents 74.1%, as first reported by the German news portal Nius.
A further 34 investigations concerned foreign-related extremism. This category includes international non-Islamist terrorism as well as international left-wing and right-wing extremism. Islamist terrorism is recorded separately.
Together, the two categories accounted for 93.7% of all new investigations. Only six concerned left-wing extremism and five right-wing extremism. The figures clearly show that the overwhelming majority of new federal investigations concern Islamist terrorism or foreign-related extremism.
The federal government has also pointed out that most Islamist investigations concern offenses committed abroad. Many are connected to the Islamic State and have links to Syria or Iraq.
The figures cover only cases recorded by federal prosecutors. Some are later transferred to state prosecutors or discontinued. It can therefore be assumed that additional investigations are also underway across Germany’s 16 federal states.
The Unknown Cost of Monitoring Islamist Threats
Monitoring Islamist Gefährder is not only a security challenge but also a substantial financial burden. Yet the federal government cannot say how high the cost is. As early as 2020, it was asked in the Bundestag about the expense of monitoring Islamist Gefährder who were legally required to leave Germany.
The government said at the time that the federal states were responsible for deciding which measures to take and how extensive they should be. However, they were not required to report either those measures or the associated costs to the Federal Criminal Police Office. The federal government therefore had no overall figure.
A case in North Rhine-Westphalia shows how resource-intensive round-the-clock surveillance can be. A 14-year-old girl classified as an Islamist threat was housed for months in a secure container on a cordoned-off site. Police officers monitored her around the clock. Even her brief daily outing took place only under the supervision of youth welfare staff and armed plainclothes officers.
The girl had allegedly attacked police officers, made threats and seriously injured a care worker with a knife at the secure facility where she had previously been housed. Several psychiatric institutions subsequently refused to admit her.
Because she was below the age of criminal responsibility at the time of the offense, the authorities could neither imprison her in the usual way nor readily place her in a suitable institution.
The case revealed what the statistics usually conceal. Police, youth welfare services and security personnel had to remain on duty day and night for a single girl. The cost of this continuous surveillance remains unknown even after two parliamentary inquiries.
In the summer of 2025, the North Rhine-Westphalian state government said it had no information about the amount spent by the district of Paderborn on her care. In March 2026, it was again specifically asked about the cost, the number of police officers deployed and the involvement of other security personnel.
Once again, it provided no figures. It said only that the costs of police operations were generally not charged separately. The state therefore kept a minor under round-the-clock guard for months without disclosing to parliament how many officers were tied up by the operation or how much it cost.
Even in a well-documented individual case, the cost of permanently monitoring a high-risk person therefore remains unclear. Nor is there any standardized nationwide calculation covering personnel, vehicles, telecommunications surveillance, interpreters, technical analysis and deradicalization programs.
The Strain on Police Capacity
Those resources are then unavailable elsewhere. Officers who spend weeks following an Islamist suspect are not investigating burglaries, drug offenses or other extremist threats. Specialists in Arabic-language communications, encrypted channels and jihadist propaganda cannot be replaced at short notice either.
Less labor-intensive measures such as reporting requirements, formal police warnings, contact bans or electronic ankle tags require fewer officers. They do not automatically stop a determined attacker.
The Federal Public Prosecutor General is now investigating what the authorities knew before the Berlin attack, how Ballout’s risk was most recently assessed and whether others were involved in its preparation.