ATbar The Berlin Vehicular Ramming Attack – What we know & Insights from ICT Experts

The Berlin Vehicular Ramming Attack – What we know & Insights from ICT Experts

22/12/2016 | by ICT Staff  

Putting things in context: Terrorism in Germany

On Monday, December 19, 2016, Germany witnessed the worst terrorist attack carried out on its soil since the 1980s. While the full identity of the attacker is still under investigation, Germany has a history of being the victim of both international and homegrown terrorism. Germany continues to be a significant target for terrorists, especially since the country joined the anti-ISIS coalition led by the United States.

Germany is a strategic and diplomatic hub of Europe and its important stature makes the country a figurehead of European and Western values. As such, Germany is considered a prime target, listed amongst countries such as France and Belgium, which have seen their fair share of terror attacks in recent times. In 2016 alone, Jihadists targeted / tried to target Germany 8 times; including a suicide bombing, attempted nail-bomb attacks, and various cold-weapon assaults (axes, knives, etc.). 

A 12-year old boy attempted to carry out two bomb attacks in Ludwigshafen, Germany. On November 26th, 2016 he placed a nail bomb at a Christmas market in the city (the bomb failed to detonate) and on December 5th, 2016 he attempted to target a building housing both the town hall and a shopping center (the backpack with the bomb was spotted by pedestrians and destroyed in a controlled explosion).

The opening of borders between European Union countries has led to increased freedom of movement, which has in turn led to a rise in transnational crime and terrorist activities. Countries in Europe can no longer be solely concerned with their own vulnerabilities, but must also be mindful of the threats posed by operatives who may enter from the surrounding region. High levels of cross-border communication and intelligence-gathering are now crucial to prevent the further perpetration of atrocities on German soil.

It is worth noting that Germany serves as a fertile ground for radicalization. Radicalized individuals have the option to remain in the country, or- as is becoming increasingly popular- travelling to theaters of Jihad abroad. These foreign fighters pose a significant risk, as when they return to their home countries, they have acquired combat field experience, knowledge, connections and expertise. With about 700 Foreign Fighters, Germany has one of the highest numbers (after France and similar to the United Kingdom) of foreign fighters of any European or Western country. As mentioned, Germany has also witnessed several terrorist attacks on its soil and it is clear that there exists in Germany a terrorist infrastructure affiliated with Global Jihadi ideology.

From International Centre for Counter-Terrorism – The Hague 

From International Centre for Counter-Terrorism – The Hague

Overview of the attack

The Vehicular Ramming Attack took place on Monday, December 19, 2016 at 20.02, when a truck plowed into a crowd on a Christmas market at Breitscheidplatz in Berlin, Germany. A couple of days after the attack, it is reported that 12 people were killed and 49 injured in the attack.

The attacker allegedly took over a truck driven by a Polish citizen, killed him and then drove the vehicle into the crowd of shoppers, locals and tourists at a Berlin Christmas Market.

A suspect of Afghani/Pakistani origin was arrested shortly after the attack but released due to lack of evidence. On December 21st, 2016, German prosecutors named Anis Amri, a 23 years old Tunisian, as the prime suspect of the attack. Amri was known to German intelligence and put under surveillance earlier this year on suspicion of trying to acquire weapons.

German authorities are looking for Anis Amri and will give 100,000 Euro  for information that can lead to his arrest 

German authorities are looking for Anis Amri and will give 100,000 Euro
for information that can lead to his arrest


ISIS claimed responsibility for the attack, stating that “the attacker is a soldier of the “Islamic State” and carried out the operation in response to appeals targeting nationals of the international coalition countries”.

 ISIS’ claims of responsibility

ISIS’ claims of responsibility

The Modus Operandi: Vehicular Ramming Attacks

The Berlin Attack is reminiscent of a similar attack which occurred during the "Bastille Day" celebrations, in July 2016, in Nice, France, which killed 86 people. The attack was carried out by a Tunisian-born French citizen, who was inspired by ISIS. The organization similarly claimed responsibility for the attack.

 Image of truck that was used in Nice, France attack during the Bastille Day celebrations

Image of truck that was used in Nice, France attack during the Bastille Day celebrations

Israel, as well, has been confronted with vehicular ramming attacks for many years. Most of these attacks used standard cars but tractors have been used as well. Throughout the last wave of “lone wolf” terrorist attacks in Israel, over 10% of attacks were conducted as vehicular ramming attacks.

Training Manuel

Al-Qaida published several training manuals on how to carry out a successful vehicular ramming attack since Inspire magazines volumes 1 & 2 (2010). In the 13th (2014) and 16th (2016) Volumes of Inspire magazine, the organization provided examples of successful vehicular ramming attacks, noting the ramming of Canadian soldiers and the attack in Nice as exemplary lone wolf attacks.

ISIS as well published its own “user manuals” on how to carry out a successful vehicular ramming attack; the most recent of which was published just a few weeks before the Berlin attack (Rumiyah, Issue 3, November 7, 2016). The publication calls for the individuals to initiate vehicular ramming attacks, pointing out the benefits of such attacks, giving detailed instructions on how to select and operate the vehicles and recommending the types of targets.

The advantages, according to the article, of using vehicles for vehicular ramming attack are the fact that a vehicle can serve as 'a weapon' which is easy to use for anyone who knows how to drive, it is significantly less suspicious than other weapons (such as a knife, for example), it is easy to obtain and can cause a large numbers of casualties. The organization summarizes these advantages: “It is for this obvious reason that using a vehicle is one of the most comprehensive methods of attack, as it presents the opportunity for just terror for anyone possessing the ability to drive a vehicle. Likewise, it is one of the safest and easiest weapons one could employ against the kuffar, while being from amongst the most lethal methods of attack and the most successful in harvesting large numbers of the kuffar”.

ISIS notes that the vehicle of choice to carry out these attacks needs to be heavy weight and as large as possible while still being able to reach high speeds. Vehicles can be bought, rented, lent, and if necessary, even acquired by theft or kidnapping of the driver.

Image of truck that can be used for terror attacks 

Image of truck that can be used for terror attacks

Finally, the article provides several targets of choice such as outdoors events and/or markets, pedestrian crowded streets, festivals, parades and political rallies.

Social Media Discourse on the Berlin Attack

Already on July 6, 2016, the ICT's Jihadist Website Monitoring Group (JWMG) discovered a re-distribution of threats by IS supporters to attack targets in Germany, especially in Berlin[1]. The threats were published on the Telegram channel, “Orlando Channel – Omar Mateen” and was designed to encourage Muslims living in the West to show initiative and carry out individual attacks, or what is referred to in jihadist terminology as “lone wolf” jihad. The channel itself was opened shortly after the terrorist attack in Orlando, which was carried out on June 12, 2016 against the LGBT community by a Muslim American citizen who swore allegiance to the Islamic State.

A screenshot of the announcement that was published on June 14, 2016 and on July 6, 2016 on Telegram

A screenshot of the announcement that was published on June 14, 2016 and
on July 6, 2016 on Telegram

Following to the Berlin Attack, social networks and jihad supporters praised ISIS’ attack and encouraged the continuation of “lone wolf" attacks against targets in the West. Most of the comments used “hashtags” such as "in their stronghold", taken from the recent Abu Bakr al-Baghdadi’s speech, calling Muslims worldwide to strike Western targets in response to the offensive waged by coalition forces against the organization. According to surfers, suppressed vengeance justified response to Germany's military participation in the war against the group in Syria. A Facebook user named Sufyan al-Khayyati, for example, called to intimidate terrorize Europe: "lone wolves in Europe, Muslims have helped your brothers as you can. Kill them, slaughtered them, trampled them, burned them, kicked them, use all means to kill the crusaders, whether they are civilians or military personnel without consulting anyone, because both are considered impure blood warrior is allowed. the blood is not immune besides [the blood of] Muslims ...”. Another surfer noted as "revenge" because Jihad operatives strike at any time and wherever they choose.

Insights from ICT Experts

Prof. Boaz Ganor, Founder & Executive Director of ICT explains that current available information indicates that the attack was carried out by an individual who was inspired by ISIS, rather than by an integral cell of the organization. The fact the ISIS claimed responsibility for the attack only shows that the organization is taking advantage of the success of an attack inspired by the group.

Accordingly, the attack might have been carried out either by a “lone wolf” or a small independent cell, most likely inspired by ISIS but not backed by its operational guidance, other than propaganda (such as Rummiya online magazine).

These type of terror attacks are difficult to counter with traditional intelligence. Hence, HUMINT and COMINT, which are designated mainly for penetrating traditional terror organizations, are not sufficient tools to be used when perpetrators are lone wolves or small independent cells. In fact, the type of intelligence needed to understand the attack or potentially prevent it, is OSINT - open source intelligence. In any case, preventing these attacks is difficult. Israel can serve as an example of the success of using OSINT to prevent lone wolf attacks during the last wave of lone wolfs terror attacks.

Lt. Col. (Res.) Uri Ben Yaakov, a Senior Researcher at ICT, explains that while ISIS is under a defensive (some may say survival) campaign in Syria and Iraq, the only way to keep the organization the focus of Muslims around the world is by shifting the battle zone and conducting terrorist attacks against the West.

In his views, vehicular ramming attacks are successful and cost effective in the eyes of the terrorists. In addition, vehicular ramming attacks are one of the preferred methods of attacks as it can be carried out by non-experienced activists.   As such, we should expect that terrorists will continue using this modus operandi in the future, as well as inspiring individuals to do the same. The security apparatus should be updated accordingly; to prevention of such attacks before they occur.

It is important to keep in mind the power of social networks in distributing the messages to wide audiences as a “force multiplier”. Terrorist organizations such as ISIS are taking advantage of the ungoverned cyber arena in order to spread their messages with little-to-no intervention by the authorities. States should consider implementing their governance on the cyber arena, in order to prevent terrorist use on this dimension for their own benefit.