On Tuesday, July 28, 2026, Germany's federal prosecutor's office announced that investigators found a video on a phone inside the van used in the Berlin Pride attack. The video shows the suspect pledging loyalty to ISIL, also known as ISIS. This is the first official sign that the attack may have been driven by extremist ideology. The announcement came three days after the assault, which killed a 65-year-old Polish woman and injured 31 people.

The suspect was Abdul Ballout, a 21-year-old German citizen of Lebanese descent. On Saturday, July 25, 2026, he drove a rented minivan into crowds gathered for Berlin's Pride celebration, known locally as Christopher Street Day (CSD).

German Interior Minister Alexander Dobrindt spoke about the finding on television, saying: "We assume the person in the video is the suspect." The German newspaper Bild was the first to report that an allegiance video had been found on the suspect's phone. The federal prosecutor's office then confirmed it.

In Germany, when terrorism is suspected, the federal prosecutor's office takes over the case from local police. That happened here on July 26, 2026. The case had started with Berlin's local authorities, and the handoff showed that German law enforcement was treating the incident as serious from the very first hours.

Berlin prosecutors also revealed that Ballout had traveled to Lebanon in 2025, saying he wanted to cross into Syria to join ISIL. This detail matters because, according to a Tagesschau report, Germany's Federal Criminal Police Office (known as the BKA) had already labeled Ballout a "high-risk person" before the attack. This label is used for people the security services believe are likely to carry out a serious politically motivated crime.

The fact that Ballout was known to authorities at that level, yet was not under constant watch or locked up at the time of the attack, will likely be a major focus of the review that follows.

Ballout was shot and killed by police on Sunday, July 26, 2026, the day after the attack, after he attacked officers with a bladed weapon. Police had also been looking into whether there was a second person involved, according to Euronews, though it is still unclear where that lead stands.

The broader context here is a tension at the heart of Germany's security system. German law allows authorities to keep a closer eye on people labeled as high-risk, but that label alone does not let them arrest someone or restrict their movements. German courts have said that to lock someone up before they commit a crime, authorities need proof of a specific, immediate threat, not just a watchlist label. This is not the first time that gap has been tested. In 2016, a man named Anis Amri drove a truck through a Berlin Christmas market after authorities had already identified him as a security threat. The details of that case and this one are different, but the comparison is already being drawn.

The choice of a Pride event as a target is also significant. ISIL's ideology is violently anti-LGBTQ, and the group has encouraged attacks on gatherings it sees as symbols of Western moral decline. Whether Ballout was acting on direct orders from ISIL or was a self-radicalized supporter following the group's general call to action is still unknown. The allegiance video is common in both ISIL-directed and ISIL-inspired plots, so it does not answer that question on its own. Federal prosecutors will now examine the phone's full contents, including messages and any signs of coordination with others.

Germany's 2025 federal elections brought a change in the governing coalition, and Interior Minister Dobrindt's handling of the case will be closely watched. Security policy, especially how the government deals with known extremist threats, is a politically charged topic in Germany. Attacks like this one add pressure on officials to show that the intelligence system can do more than just identify threats after they happen.

The investigation now focuses on three questions: whether Ballout had accomplices, whether his 2025 trip to Lebanon involved contact with ISIL networks, and whether the intelligence services followed their own rules when handling his high-risk label. Those answers, not the video alone, will determine whether this becomes a story about the limits of the system or about a failure to use it.