Anthony Krumme, Camilla Raffaelli, Alberto Grosselli, Anna Leda, EUCOM Team
James Raggio, Editor; Radhika Ramalinga Venkatachalam, Senior Editor
December 26, 2024
A German Christmas Market[1]
Introduction
A car-ramming attack in Magdeburg, Germany, killed at least five people and injured around 200 people.[2] The incident occurred at a Christmas market and one suspect has been arrested and charged with multiple counts of murder and attempted murder.[3] The 50-year-old male suspect is a psychiatrist from Saudi Arabia who has lived in Germany since 2006 and is an Islam critic and asylum activist.[4] The attack follows a warning by German Interior Minister Nancy Faeser for general vigilance around Christmas markets due to a high threat level.[5]
Summary
The attack occurred on December 20, 2024, in Magdeburg, the state capital of Saxony-Anhalt in eastern Germany. At least five people were killed and 200 injured, with at least 40 in critical condition.[6] Immediately after the attack, officials announced plans to significantly increase security by deploying additional staff to Christmas markets and other high-profile locations across the city.[7] Following the incident, authorities promptly cordoned off the area, citing concerns that the suspect’s truck might contain explosives.[8] The suspect, identified as Taleb Al Abdulmohsen, is a 50-year-old psychiatrist from Saudi Arabia who has been in Germany since 2006 and is known for his outspoken criticism of Islam, the Saudi government, and Germany for its handling of Saudi refugees, as well as for supporting far-right parties, including Alternative for Germany (AfD).[9] While authorities are still investigating the crime and trying to establish a motive, they consider it a deliberate attack, as the suspect purposefully drove a rented car at high speed into the crowds of the Christmas market.[10] Initial reports reveal that the suspect had a history of mental health struggles and expressed paranoid beliefs online. He accused German authorities of persecuting him and obstructing his activism, which primarily involved helping Saudi women seek asylum abroad.[11] Beyond personal grievances, his social media posts blame the “German nation” collectively for the persecution of contemporary Islam critics and the “death of Socrates.” Al Abdulmohsen believes European and North American societies to be the spiritual descendants of the Greek philosopher, which Germany is undermining through “Islamization.”[12] Recent social media activity by the suspect includes posts with threatening language against Germany and references to violence. Investigators are examining whether radical views or personal grievances drove him.[13]
According to a Saudi source, Saudi Arabia had repeatedly warned German authorities about the suspect, citing radical information on his personal X account that threatened peace and security.[14] These concerns were expressed several times, starting immediately after Taleb Al Abdulmohsen left Saudi Arabia in 2006.[15] Despite these warnings, he was granted refugee status 10 years later.[16]
The attack bears similarities to the 2016 truck ramming attack on the Christmas market at Breidscheidplatz, Berlin, which killed 12 people. The 2016 attack was carried out by a jihadist with links to ISIS and spawned increased security measures for public spaces, including vehicle barriers.[17] The German government installed concrete barriers and bollards at vulnerable locations to prevent ramming attacks at the market in Magdeburg, yet failed to prevent or considerably curtail the attack.[18]
In response to the recent surge in attacks and threats, the German government introduced a “security package” in November 2024, focusing on terrorism prevention, migration control, and weapons restrictions.[19] Measures included enhanced migration controls, such as restrictions on benefits for migrants whose claims were rejected, enhanced powers for monitoring terror financing, and improved data-sharing mechanisms for law enforcement authorities. The “security package” also included restrictions such as knife bans in public spaces and on public transport and temporary border checks at land crossings to combat illegal migration and cross-border terrorism.[20]
The recent attack at Magdeburg immediately caught the attention of online users, especially on the messaging app Telegram, and numerous messages have been shared by users and groups belonging to different denominations of far-right, alt-right, and conspiracist beliefs.[21] The initial uncertainty investigators had about the motive behind the attack gave enough leeway for conspiracy theories to spread easily throughout group chats and public channels, as users spread misinformation and conspiracy theories that most aligned with their own political views.[22] Neo-nazi groups on the app spread messages linking the attack to antisemitic conspiracies, leveraging the perpetrator’s past support for Israel and his disdain for Islam, as portrayed through his social media posts.[23] Several other conspiracist groups and social media personalities started spreading doubts over the validity of the investigations and some of the perpetrator’s far-right beliefs, with posts reaching audiences of more than 20,000 users as of Saturday, December 21.[24]
Analysis
The attack will almost certainly revitalize anti-immigrant and anti-Islamic sentiments in Germany, and the suspect’s anti-Muslim views will very unlikely change the community’s reaction. The attack will very likely be exploited for political purposes by far-right parties through the demand for strict controls on immigration, likely highlighting how security services ignored warnings about the danger posed by the suspect, and sparking renewed debate on the large immigrant communities, especially Turkish and Syrian, in Germany. The upcoming general election, set for February 23, 2025, will very likely feature security and immigration as two of the most prominent talking points, and parties promising strict regulations from both sides of the political spectrum, such as the far-right AfD and the populist left Bündnis Sahra Wagenknecht, will likely see a significant increase in public support. The attack, in addition to the renewed attention toward immigrant communities and the likely growth of anti-immigrant parties, will very likely cause non-native Germans to feel more threatened. The attack in Magdeburg, which was likely driven by resentment toward German citizens, will likely cause many civilians to look at immigrant communities with increased suspicion.
The attack will almost certainly cause security measures to increase significantly, both in Germany and other European countries where Christmas markets are popular, such as Austria, France, and Italy. The event’s dynamic will likely cause other European countries to investigate whether the safety measures already in place are effective, with a particular focus likely on why concrete barriers failed to stop the suspect’s car. There is a roughly even chance that the improvements in the security posture, which will likely start immediately and last at least until the New Year’s Eve celebrations, will include the deployment of members of the military forces as an additional precaution. The investigation will likely focus on whether signals of violence or “red flags” were ignored, as German citizens will very likely expect police and security services to take on the responsibility if the allegations about multiple ignored warnings were proved true. The confirmation of these allegations will likely lead to a reassessment of priorities in the security services’ internal structure, which will likely include a review of the risk assessment processes and the evaluation of external threat reporting.
The information currently available on the suspect likely suggests that the attack is an isolated case and does not imply a return of mass terrorist attacks similar to the period Europe experienced between 2015 and 2017. The suspect’s apparent ideology and motive, while still unclear, are unlikely to be widely shared by other immigrants, and are thus very unlikely to inspire copycats to replicate the attack, as that rhetoric is more common with far-right groups that are not typically popular with immigrant communities. The Arab heritage of the suspect, very likely an outlier within far-right extremist groups in Germany, makes him unlikely to become a symbol for far-right groups to emulate. Far-right groups will likely exploit the suspect’s Arab heritage to craft divisive narratives that resonate with their audiences, very likely framing the event as evidence of cultural or societal conflicts. The suspect’s modus operandi likely does not represent a novelty that could motivate other groups or lone wolves to emulate this attack in the future because of its features. This particular attack is unlikely to create future copycat attacks, as similar far-right attackers will likely employ different tactics and not choose culturally significant targets for German culture, such as Christmas markets. Simultaneously, European intelligence services almost certainly monitor known Islamist cells closely, making the organization of vehicle-ramming attacks harder and thus unlikely for these groups.
The increased social fear caused by the recent terrorist attack will almost certainly have a significant impact on local businesses at Christmas markets in Germany. The regions famous for their festive markets in the country will very likely experience a decline, with travelers likely viewing these locations as less safe, likely triggering a ripple effect, affecting hotels, restaurants, and other holiday-related services. The lack of seasonal revenue will likely put financial pressure on small businesses, very likely leading to closures or staff reductions. Over time, the community will likely face high unemployment rates, particularly in regions that depend heavily on tourism and holiday markets, which will very likely diminish the region’s cultural identity.
Mental health struggles and paranoia very likely played a central role in shaping the suspect’s radical views and resentment toward authorities, contributing to him carrying out the attack. His documented accusations of persecution by German authorities likely fueled feelings of resentment and victimization, reinforcing his grievances and justifying his violent action. Statements such as the ones blaming the German nation for persecuting Islam critics and for the death of Socrates likely indicate mental health issues. The statements likely also indicate a justification for attacks against civilians, as no differentiation is made between the German authorities and German citizens. Authorities will very likely examine whether gaps in mental health support and failures to address online warnings allowed for the suspect’s grievances and violent ideation to escalate due to a lack of medical intervention and whether the attack could have been prevented.
Numerous online actors will almost certainly spread misinformation and disinformation on the events, the perpetrator’s beliefs and motivations behind the attack, and the investigations, very likely exploiting social media apps such as Telegram and X (formerly known as Twitter). The misinformation around the attack and the perpetrator will very likely pertain to his belief system and the precipitants leading to the attack, likely focusing on his status as a migrant worker and his Arab heritage. There’s a roughly even chance that anti-immigrant groups online, such as more extremist supporters of the AfD, will spread misinformation about his faith, falsely representing him as an extremist Islamist, likely exploiting this event to renew their calls for reduced migration inflows. Disinformation around this event will very likely exacerbate preexisting societal polarization, with opposing groups likely engaging in online debates amplified by the echo chambers on social media platforms such as X.
Recommendations
Civilians at large public gatherings, such as Christmas markets, should be vigilant and aware of their surroundings. Civilians should report suspicious activities and remember escape routes to quickly evacuate in an emergency. However, civilians should not respond to this attack by refusing to attend large public gatherings out of fear. If possible, civilians should take first aid and basic trauma courses to be able to aid in the immediate aftermath of a mass casualty event.
To mitigate the spread of misinformation and disinformation, authorities and social media platforms should prioritize real-time monitoring of online activity, particularly on platforms such as Telegram and X, to identify and address harmful content. Transparent and timely communication from authorities about the findings of the investigations will be crucial to counter speculation and conspiracy theories. Fact-checking organizations should collaborate with social media platforms to amplify accurate information, while the German government and other relevant institutions, such as the European Digital Media Observatory, could launch awareness campaigns to educate the public on identifying and resisting misleading narratives.
Security services should investigate the motive of the suspect to establish whether the suspect’s grievances are widespread within the immigrant communities or far-right groups and whether other members of these communities are planning to perpetrate similar attacks. The investigation should also verify whether the suspect acted alone, driven by his ideology, or cooperated with an accomplice, who might have driven him to act on his grievances. Security services should investigate the suspect’s social media presence, focusing on the accounts that interacted with the suspect’s posts detailing his extremist views or his plans to commit “revenge” against the German state and its people. Law enforcement should place under close surveillance or question the suspect's followers or known acquaintances who expressed similar views or shared the same opinion on the issues highlighted by the suspect.
Immigrant communities in Germany, especially those composed of Muslims or immigrants with an Arab heritage, should be wary of the growing hateful sentiments and aware of their surroundings, particularly near mosques or other locations popular with immigrant communities. Immigrants and Muslims should remain informed on possible far-right gatherings or rallies and avoid them to reduce the risk of being involved in violence or receiving hateful remarks and insults.
Unlock the Power of Knowledge with The Counter Threat Center! Elevate your threat detection capabilities with critical intelligence on global threats. Join us for a free trial and equip yourself to safeguard those you've sworn to protect. Click here to learn more: https://www.counterthreatcenter.com/subscriptions
[1] Göttingen, Germany, by CTG Member
[2] What is known about the attack in Magdeburg, Tagesschau, December 2024, https://www.tagesschau.de/inland/innenpolitik/magdeburg-faq-102.html (Translated by Google)
[3] Suspect in German Christmas market attack held on murder charges, Reuters, December 2024, https://www.reuters.com/world/europe/suspect-german-christmas-market-attack-held-murder-charges-after-night-grief-2024-12-22/
[4] This is what we know about the suspect in Magdeburg, Tagesschau, December 2024, https://www.tagesschau.de/inland/gesellschaft/attentaeter-magdeburg-100.html (Translated by Google)
[5] Faeser urges vigilance at Christmas markets, Tagesschau, November 2024, https://www.tagesschau.de/inland/faeser-mahnt-auf-weihnachtsmarkt-zu-wachsamkeit-100.html (Translated by Google)
[6] What is known about the attack in Magdeburg, Tagesschau, December 2024, https://www.tagesschau.de/inland/innenpolitik/magdeburg-faq-102.html (Translated by Google)
[7] Car plows into Christmas market in Germany, killing at least 5 and injuring 200, NBC News, December 2024, https://www.nbcnews.com/news/world/car-ramming-christmas-market-germany-rcna185066
[8] Germany: At least two dead and almost 70 injured after car ploughs into crowd in city of Magdeburg, Sky News, December 2024, https://news.sky.com/story/germany-at-least-one-dead-after-car-driven-into-people-at-christmas-market-13277301
[9] This is what we know about the suspect in Magdeburg, Tagesschau, December 2024, https://www.tagesschau.de/inland/gesellschaft/attentaeter-magdeburg-100.html (Translated by Google)
[10] What is known about the attack in Magdeburg, Tagesschau, December 2024, https://www.tagesschau.de/inland/innenpolitik/magdeburg-faq-102.html (Translated by Google)
[11] This is what we know about the suspect in Magdeburg, Tagesschau, December 2024, https://www.tagesschau.de/inland/gesellschaft/attentaeter-magdeburg-100.html (Translated by Google)
[12] @DrTalebJawad, X, December 2024, https://x.com/DrTalebJawad/status/1870169159419494729
[13] This is what we know about the suspect in Magdeburg, Tagesschau, December 2024, https://www.tagesschau.de/inland/gesellschaft/attentaeter-magdeburg-100.html (Translated by Google)
[14] German Christmas market attack kills five, injures 200, Reuters, December 2024, https://www.reuters.com/world/europe/death-toll-german-christmas-market-car-ramming-rises-four-bild-reports-2024-12-21/
[15] Ibid
[16] The 'atheist' Saudi refugee suspected of Germany attack, France24, December 2024, https://www.france24.com/en/live-news/20241221-the-atheist-saudi-refugee-suspected-of-germany-attack
[17] Truck plows into Berlin Christmas market, killing 12, DW, December 2016, https://www.dw.com/en/germany-on-edge-after-truck-plows-into-berlin-christmas-market-killing-12/a-36838008
[18] Christmas market attack at Magdeburg: what we know about the circumstances, victims and suspect, NOS, December 2024, https://nos.nl/artikel/2549126-aanslag-kerstmarkt-maagdenburg-dit-weten-we-over-toedracht-slachtoffers-en-verdachte (Translated by Google)
[19] More Security for Germany, Die Bundesregierung, October 2024, https://www.bundesregierung.de/breg-de/aktuelles/sicherheitspaket-der-bundesregierung-2304924 (Translated by Google)
[20] Ibid
[21] Threat Hunter on Telegram
[22] Ibid
[23] Ibid
[24] Ibid