EMET NEWS PRESS

Situation Assessment I

Officers of the Bavarian State Criminal Police Office (BLKA) arrested the Iraqi suspect on July 23, 2026, in Traunreut, Traunstein district. The Syrian suspect was arrested on July 28 in Weiden in der Oberpfalz. Local police units and specialized state-security divisions supported the operations. The investigations are directed by the Bavarian Central Office for Combating Extremism and Terrorism (ZET), which forms part of the Munich Public Prosecutor General’s Office.

The Iraqi suspect is accused of serving as a fighter in several IS units in Iraq and Syria between January and September 2016. The Syrian suspect allegedly served with the IS police and several combat units between February and July 2016. Both men are alleged to have received monthly payments from the organization. The Public Prosecutor General’s Office assesses the cases as independent investigations connected solely by their subject matter.

At the request of the Public Prosecutor General’s Office, an investigating judge at the Munich Higher Regional Court issued arrest warrants that were served and executed on the respective dates of arrest. The allegations concern participation as a member of a terrorist organization abroad under Section 129a(1), no. 1, in conjunction with Section 129b(1) of the German Criminal Code. Both suspects are being held in Bavarian correctional facilities.

Situation Assessment II

Approximately ten years separate the alleged deployments in 2016 from the arrests on July 23 and 28, 2026. The evidentiary basis apparently developed first through document exploitation and identity verification, followed by the later consolidation of evidence to the standard required for criminal proceedings.

The simultaneous announcement of both investigations does not establish a shared operational connection. The only confirmed common element is the source category: datasets derived from internal IS records. The authorities’ reference to “extensive investigations” indicates additional verification measures whose contents remain undisclosed because the proceedings are continuing. The publicly available material supports an assessment of the investigative method, while providing no basis for determining individual guilt.

The official suspicion must be distinguished from analytical conclusions; official attributions remain identified as such. The arrest warrants show that the Munich Higher Regional Court found an urgent suspicion of criminal conduct on the basis of the submitted case files. The press release does not disclose which evidence was presented in addition to the lists or which grounds for detention were cited by the investigating judge.

Arrests and Core Allegations

The Munich Public Prosecutor General’s Office accuses both suspects of serving in IS combat units. The Syrian suspect is additionally alleged to have served in the IS police. This structure formed part of the organization’s governing and coercive apparatus within the territory it controlled. The Public Prosecutor General’s Office has disclosed no specific acts against detainees or civilians.

In both investigations, the Munich Public Prosecutor General’s Office cites monthly IS payments as part of the alleged facts. Regular remuneration may support a finding of organizational integration when the relevant record can be attributed conclusively to an individual and corroborated by further evidence. Payment records may also indicate the duration and nature of an assignment. A name entry alone remains vulnerable to spelling variations and inaccurate personal data; aliases further complicate definitive identification.

The current public record contains no information about when the suspects entered Germany or their immigration status. Any findings from previous security screenings also remain unknown. Their present ideological alignment and the extent of any earlier surveillance measures have not been disclosed. The alleged activities in 2016 therefore provide no reliable basis for assessing a current operational threat.

Documentary Sources and Identity Matching

The Public Prosecutor General’s Office identifies an IS membership register and other IS lists as the starting point of the investigations but does not explain their provenance. A judgment issued by the Munich Higher Regional Court on November 15, 2024, provides a documented comparison. In that separate case, the state-security panel relied on an IS membership register and a central payroll list. The so-called OP Raven list provided an additional dataset.

According to the court’s findings, coalition forces obtained the file described as the IS membership register near Hasakah, Syria, on December 27, 2017. The FBI subsequently transferred it to the German Federal Criminal Police Office. The file contained personal master data and internal census numbers. The Arabic term Kunya appeared in connection with combat names. The records also included information on remuneration and unit assignment.

In the earlier proceedings, the panel assessed the documents as authentic but based its conclusion on a broader evidentiary chain. The names of relatives and tribal information corresponded with the defendant’s identity. The combat name recorded in the lists was also traceable in Telegram and Facebook data. This combination illustrates the investigative method: a list entry initiates the inquiry, while digital traces and personal records strengthen the attribution.

These findings cannot be transferred directly to the two current suspects. They demonstrate the previously tested provenance and structure of comparable datasets. It remains unclear whether the present investigations rely on the same files or on additional versions. Supplementary records may also form part of the evidence.

Battlefield Evidence as an Investigative Basis

The IS lists qualify as Battlefield Evidence when they were obtained during military operations in a conflict zone. Eurojust uses the term for digital and physical material transferred from armed conflicts to law-enforcement authorities by military or civilian actors. Such material includes communications data and administrative or payroll records belonging to terrorist organizations.

Internal personnel numbers and payment entries may reveal relationships that are difficult to reconstruct through open sources. Unit information can further define an alleged assignment. Comparing the entries with population registers and asylum files may convert anonymized or transliterated records into identifiable personal links. Data recovered from seized devices provides another avenue for verification.

Courts and investigators must be able to reconstruct the provenance and integrity of the records. The chain of transmission must also be documented. Translation issues and the interpretation of internal organizational terminology create additional evidentiary requirements. Eurojust further emphasizes the importance of declassifying source material and providing expert contextualization. These measures support judicial scrutiny and safeguard the rights of the defence.

The two Bavarian investigations demonstrate the long-term value of this approach. Captured datasets retain investigative utility when new identity information or residence data permits a reliable match. The interval preceding an arrest may result from delayed identification or prolonged verification. The evidentiary threshold required for criminal proceedings may also have been reached only at a later stage. The available information does not establish which explanation applies.

Legal Jurisdiction and Evidentiary Threshold

Section 129a of the German Criminal Code covers, among other conduct, the formation of terrorist organizations and participation as a member. Section 129b extends the provision to organizations based abroad. German authorities may therefore prosecute alleged IS membership even when the relevant acts occurred outside Germany.

Section 112 of the German Code of Criminal Procedure generally requires an urgent suspicion and a statutory ground for detention before pretrial detention may be ordered. Paragraph 3 establishes an enhanced detention provision for allegations under Section 129a(1) or (2) in conjunction with Section 129b(1). The proportionality requirement continues to apply. The arrest warrant must identify the underlying facts and the ground for detention unless state-security interests preclude disclosure.

The investigating judge at the Munich Higher Regional Court found an urgent suspicion and ordered pretrial detention; that decision does not determine the suspects’ eventual criminal liability. An indictment and conviction require an evidentiary chain that exceeds the present threshold of suspicion. The proceedings must examine the authenticity and individual attribution of the records, together with whether the alleged activities establish actual integration into the organization.

Security Context and Analytical Limits

The 2025 Report on the Protection of the Constitution, presented on June 30, 2026, estimated Germany’s Islamist extremist potential at 28,645 individuals. The violence-oriented segment declined slightly from the previous year to approximately 9,110 individuals. Federal Interior Minister Alexander Dobrindt and Federal Office for the Protection of the Constitution President Sinan Selen continued to classify Islamist extremism as a relevant component of Germany’s security environment.

The two arrests cannot be equated statistically or operationally with this overall population. The domestic intelligence report covers current extremist activity and known support structures, whereas the Bavarian investigations concern alleged membership conduct dating from 2016. Public information does not establish whether the suspects are currently included in the recorded Islamist extremist population.

The Bavarian investigations nevertheless carry security-policy significance. They show that individuals suspected of serving in the territorial IS structure can still be identified and prosecuted years after their documented activities ended. Current contacts and digital communications require separate examination. Possible financial relationships constitute another investigative avenue. No results in these areas have been released.

Intelligence Assessment

The arrests mark a successful application of retrospective document exploitation. The principal capability gain derives from combining captured organizational records with identity and residence data available to German authorities. International information exchange and specialized state-level jurisdiction form the visible investigative architecture. Judicial review of the detention orders completes the criminal-procedure chain.

This method increases prosecutorial pressure on IS and former members of its territorial structures. Internal administrative records remain effective after the organization has lost territorial control and may reconstruct former functions and aliases. Payroll documents allow financial relationships to be traced separately. The passage of time and the use of changing identities consequently provide less protection. Migration complicates access to suspects but does not eliminate the value of the captured datasets.

The publicly available findings establish neither a joint structure in Bavaria nor current attack preparations. Further arrests arising from the same dataset or new proceedings based on identical census numbers would constitute verifiable indicators of a broader investigative series. Evidence of continuing communications or financial ties would also alter the assessment. Pending further disclosures, the two cases are best classified as investigations into historical IS membership with potential present-day relevance.

Glossary

Battlefield Evidence
Information and physical material obtained from armed-conflict zones that may be used as evidence in criminal investigations and judicial proceedings.

BLKA
Bavarian State Criminal Police Office; the central state-level criminal police authority of Bavaria.

IS Membership Register
An internal Islamic State dataset containing personal and organizational information, sometimes including remuneration records.

Kunya
An Arabic teknonym or byname frequently used as a combat name or alias within jihadist organizations.

Census Number
An internal identification number used by IS to record members in administrative and payroll documents.

ZET
Bavarian Central Office for Combating Extremism and Terrorism within the Munich Public Prosecutor General’s Office.

Persons Register

Alexander Dobrindt
Federal Minister of the Interior; presented the 2025 Report on the Protection of the Constitution with the BfV president on June 30, 2026.

Sinan Selen
President of the Federal Office for the Protection of the Constitution; responsible for federal domestic-intelligence assessments concerning Islamism and Islamist terrorism.

References

Bavarian State Criminal Police Office
Two Arrests in Traunreut and Weiden i.d.Opf.: Munich Public Prosecutor General’s Office Obtains Arrest Warrants on Suspicion of Membership in the “Islamic State” Terrorist Organization
July 29, 2026
polizei.bayern.de/aktuelles/pressemitteilungen/106424/index.html

Munich Higher Regional Court
Criminal Proceedings against Moaaz A. on Suspicion of Membership in a Terrorist Organization Abroad
November 15, 2024
justiz.bayern.de/gerichte-und-behoerden/oberlandesgerichte/muenchen/presse/2024/72.php

Eurojust
Battlefield Evidence: Key Insights for Judicial Practitioners
November 25, 2025
eurojust.europa.eu/publication/battlefield-evidence-key-insights-judicial-practitioners

Eurojust
Battlefield Evidence Increasingly Used to Prosecute Foreign Terrorist Fighters in the EU
September 15, 2020
eurojust.europa.eu/news/battlefield-evidence-increasingly-used-prosecute-foreign-terrorist-fighters-eu

Federal Ministry of Justice
German Criminal Code – Section 129a: Formation of Terrorist Organizations
Accessed: July 29, 2026
gesetze-im-internet.de/stgb/__129a.html

Federal Ministry of Justice
German Criminal Code – Section 129b: Criminal and Terrorist Organizations Abroad
Accessed: July 29, 2026
gesetze-im-internet.de/stgb/__129b.html

Federal Ministry of Justice
German Code of Criminal Procedure – Section 112: Conditions for Pretrial Detention
Accessed: July 29, 2026
gesetze-im-internet.de/stpo/__112.html

Federal Ministry of the Interior
2025 Report on the Protection of the Constitution Presented
June 30, 2026
bmi.bund.de/SharedDocs/pressemitteilungen/DE/2026/06/vsb2025-pm.html