Deadly berlin pride attack prompts urgent review of eu intelligence-sharing

A deadly attack at Berlin’s Pride parade has renewed scrutiny of how EU member states share intelligence on suspected extremists and monitor their movements across borders.

The suspect, 21-year-old Abdul Ballout, had travelled outside the Schengen Area before returning to the EU, yet was not detained despite his known links to Islamist extremism.

A German citizen of Lebanese descent, Ballout had been known to German police and intelligence services for several years because of his involvement in Islamist extremist activities. He had travelled to Turkey looking to enter Syria.

The case has reignited questions over whether Europe’s intelligence-sharing and cross-border security systems are capable of identifying and stopping individuals who may go on to carry out terrorist attacks.

Best known as the database underpinning the Schengen Area’s passport-free travel zone, the Schengen Information System (SIS) also enables police, border guards and customs officers in 31 European countries to access real-time alerts on wanted criminals, missing persons and individuals linked to terrorism and other serious crimes.

Since the upgraded SIS was introduced in 2023, member states have been able to issue alerts on people suspected of involvement in terrorist activities, allowing authorities in another Schengen country to carry out discreet or targeted checks if those individuals are stopped during police controls or border inspections.

Role of member states

According to the European Commission, counterterrorism remains primarily the responsibility of individual member states, but the EU continues to strengthen cooperation through intelligence sharing and common security tools.

“The Schengen Information System – the EU’s common security database – allows national authorities to identify and locate terrorist suspects,” a Commission spokesperson told EU News, adding that member states are already required to create alerts for all terrorist-related offences.

The Commission said the system is consulted billions of times each year and has helped identify dozens of terrorist suspects. It contains millions of alerts and is used daily by law enforcement and border authorities across the Schengen Area, making it one of Europe’s most widely used security databases.

An incomplete intelligence picture

The effectiveness of Europe’s cross-border monitoring has come under renewed scrutiny following the deadly attack on Berlin’s Pride celebrations.

German authorities identified the suspect as Abdul Ballout, 21, a German citizen of Lebanese descent who had been known to intelligence services for several years. He had previous convictions for assault and robbery and had repeatedly attempted to travel to Syria via Turkey and Lebanon to join the so-called Islamic State group.

In May 2026, a Berlin juvenile court sentenced him to one year and 10 months in youth custody for preparing a serious act of violence, attempting to join the jihadist organisation and disseminating its propaganda online.

Prosecutors appealed the sentence, arguing that it was too lenient. During the appeal process, however, the court ruled there were no longer sufficient grounds to keep him in custody and ordered his release.

Authorities had also ordered him to undergo a deradicalisation programme before he rammed a van into Berlin’s Pride parade, killing one woman and injuring 29 others in a shocking attack. The German Chancellor Friedrich Merz called it “heinous”.

Although the Schengen Information System enables terrorism-related alerts to be shared across borders, there is no EU-wide intelligence register showing how many people are under surveillance for suspected involvement in Islamist extremist networks.

Instead, intelligence gathering remains a national responsibility, with each member state applying its own legal definitions, surveillance thresholds and monitoring practices.

A patchwork of national watchlists

European countries use different systems to monitor suspected extremists, making direct comparisons difficult because each applies its own legal definitions, monitoring criteria and threat classifications.

Germany estimates its Islamist extremist scene at around 28,000 people, including roughly 450 individuals classified as potential violent offenders (“Gefährder”).

France’s FSPRT watchlist contains several thousand people considered at risk of violent radicalisation, while Belgium’s GGB T.E.R. database lists 529 priority entities, 446 of them linked to Islamist extremism. In the UK, MI5 says it manages around 43,000 “subjects of interest” across all terrorism investigations.

Europol, however, does not maintain its own EU-wide intelligence watchlist. Counterterrorism remains the responsibility of member states, while the agency supports cross-border investigations through intelligence analysis, operational coordination and information sharing.

Schengen system has clear limits

The result is a layered European security framework: the SIS allows countries to trace terrorism suspects across borders, while national intelligence agencies decide who should be monitored, how they are assessed and what action should be taken.

The Berlin attack has nevertheless raised fresh questions over whether intelligence sharing and national surveillance mechanisms are sufficient to identify individuals who may progress from extremist sympathies to acts of violence.

Despite its role in tracking suspects travelling across borders, experts say the Schengen Information System has inherent limitations.

“The SIS is a powerful tool, but it was designed to identify individuals as they cross borders,” Christian Kaunert, Professor of International Security at Dublin City University, told EU News.

He said counterterrorism intelligence sharing across the EU still relies largely on voluntary cooperation between member states.

“There is no law enforcement mechanism that obliges member states to share this information,” he said, noting that national authorities may withhold sensitive intelligence to protect ongoing investigations or avoid the additional resources required for cross-border cooperation.