Phil Gurski on Counterterrorism, Radicalization, and the Evolution of Terrorist Ideologies

Author(s): Scott Douglas Jacobsen

Publication (Outlet/Website): A Further Inquiry

Publication Date (yyyy/mm/dd): 2025/03/26

Phil Gurski is the President and CEO of Borealis Threat and Risk Consulting. He worked as a senior strategic analyst at CSIS (Canadian Security Intelligence Service) from 2001-2013, specializing in Al Qaeda/Islamic State-inspired violent extremism and radicalization.  From 1983 to 2001, he was employed as a senior multilingual analyst at Communications Security Establishment specializing in the Middle East.  He also served as senior special advisor in the National Security Directorate at Public Safety Canada from 2013 until he retired from the civil service in May 2015 and as a consultant for the Ontario Provincial Police’s Anti-Terrorism Section (PATS) in 2015.  Mr. Gurski has presented on Al Qaeda/Islamic State-inspired violent extremism and radicalization across Canada and around the world.  He is the author of “The Threat from Within: Recognizing Al Qaeda-inspired Radicalization and Terrorism in the West” (Rowman and Littlefield) and “Western Foreign Fighters: The Threat to Homeland and International Security” (Rowman and Littlefield). He regularly blogs (Terrorism in Canada and the West – available on his Web site) and tweets on terrorism. Gurski, a counterterrorism specialist, discusses the dilution of the term “expert,” particularly in counterterrorism studies post-9/11. He distinguishes between practitioners with field experience and academics who analyze terrorism theoretically. Gurski traces modern terrorism to anarchist movements in the 19th century and references David Rapoport’s Four Waves of Terrorism model. He critiques broad definitions of terrorism, arguing it must involve serious violence for ideological, religious, or political goals. He emphasizes the challenges of counterterrorism, highlighting intelligence thresholds and the unpredictability of radicalization. Security services must discern genuine threats from mere online rhetoric, making prevention highly complex.

Scott Douglas Jacobsen: Today, we are here with Phil Gurski. We are launching a series for Free Inquiry, and I am delighted to call this my very first series following an interview with Dr. Herb Silverman for A Further Inquiry. Matthew and Khadija, I’ve happily joined their editorial team, and I feel very privileged and grateful for this opportunity.

To open this series—which may eventually become a book—we will explore counterterrorism and counter-extremism, defining terrorism and extremism in the process. Before starting, we briefly discussed it, and you made an astute point.

I appreciate the term “expert” because I approach this topic as a freelance journalist surveying experts. However, you pointed out that the term has lost much of its meaning or has been diluted. That is an interesting observation.

Phil Gurski: I recognize that most media outlets seek comments, insights, or perspectives from individuals they label as “experts.” For example, suppose a news report covers wildfires in British Columbia. In that case, the outlet may introduce a guest by saying, “We have brought in an expert to discuss why wildfires are a problem and how we can stop them.”

More specifically, in the field of counterterrorism and counter-extremism, we have seen what I would call an explosion—no pun intended—of individuals referring to themselves as experts, particularly since 9/11. There are generally two categories of people who comment on terrorism. The first group consists of practitioners—or, in my case, ex-practitioners—who have worked in counterterrorism within law enforcement, intelligence agencies, or similar fields. The second group consists of academics who study terrorism from a theoretical perspective.

I have no issue with academics writing about terrorism, and I count many among my friends. However, following 9/11, due to the sheer enormity of the attack, many people suddenly jumped on the bandwagon. Individuals who could not spell Al-Qaeda on September 10 learned to spell it on September 12 and soon claimed to be Al-Qaeda experts.

This trend was unnecessary and often driven by self-promotion. Thomas Friedman, a renowned New York Timesjournalist, once made an insightful remark—one I first heard from a podcast guest of mine. He noted that, in the aftermath of 9/11, whenever he saw a news ticker reading “Coming up next: Terrorism Expert” on CNN or MSNBC, he took it as his cue to switch to the Golf Channel. He did not think highly of the term “terrorism expert.”

Terrorism, as a phenomenon, has dominated our attention for the past quarter-century. However, terrorism did not begin on 9/11. In the modern sense, it dates back at least 50 years. But the sheer scale of 9/11—along with its symbolic targets in New York and Washington, striking at the heart of the United States—brought the issue to global prominence. Consequently, many people rushed to make their voices heard, and the field of counterterrorism expanded rapidly.

As a result, I have always been transparent about my professional background. I worked in HUMINT for the Canadian Security Intelligence Service (CSIS) and SIGINT at the Communications Security Establishment (CSE). I have written seven books on terrorism, contributed to blogs, hosted podcasts, and participated in media interviews worldwide. I have also travelled extensively to discuss these issues.

But because of what I call the cheapness of the term and the fact that it has essentially become all but meaningless, I prefer to be called a terrorism and counterterrorism specialist to avoid association with people who, frankly, have never worked in the field.

Let me give you an analogy. I spent thirty-two years in intelligence, and the media here in Canada often asks, “This major cyberattack took place—can you comment on it?” Cybersecurity is obviously part of the Canadian Security Intelligence Service (CSIS), particularly in the Communications Security Establishment (CSE) and CSIS.

And my response is, “I can’t spell cyber. I never worked in that field. I’m useless. If my keyboard works in the morning, I’m a happy camper. I will never portray myself as a cyber expert.”

So, I’d prefer the term expert be used very sparingly. I prefer a clear distinction between those who study terrorism and those who have worked in counterterrorism. These are two very distinct perspectives. There is room for both, but the term has expanded beyond its usefulness over the past quarter-century.

Rather, it is a long answer to a short question.

Jacobsen: In that response, you noted the modern sense of terrorism. What did it mean more than a hundred and fifty years ago?

Gurski: It didn’t mean anything. The term itself did not enter the English language until the 19th century. Interestingly, it first appeared in response to violent Irish nationalism—those attempting to establish an independent Ireland.

If you go back far enough, yes, there was the Reign of Terror in France, but that wasn’t terrorism—it was mob violence. It was not terrorism in the sense that we use the term today.

Most scholars agree that the true origins of modern terrorism can be traced to anarchist groups or individuals in the late 19th and early 20th centuries who targeted heads of state to try to change the political system. Think of the assassination of Archduke Franz Ferdinand on the eve of World War I—that was carried out by an anarchist. President William McKinley was assassinated by an anarchist in Buffalo, New York. An Italian king was assassinated, and anarchists also killed a Russian tsar.

When we talk about assassinations, we generally refer to politically motivated murders. One of the crucial points about terrorism is that it is an act of violence for an underlying cause—it is not random violence. It is not violence for the sake of violence; it is violence intended to advance an idea.

Currently, in Canada, we define terrorism as violence perpetrated for ideological, religious, or political reasons. These are the three primary drivers of terrorism as we legally define it.

If I may use that term loosely, the anarchist movement of the late 19th and early 20th centuries represents the first manifestation of modern terrorism.

Jacobsen: Were most terrorist activities in that earlier period—where heads of state or major political figures were being murdered—driven by anarchist ideologies?

Gurski: More often than not, they were.

A friend of mine, a scholar named David Rapoport, is probably in his nineties now. He wrote a very influential paper called The Four Waves of Terrorism, which remains one of the most significant academic contributions to our understanding of the evolution of terrorism.

He categorized terrorist movements into four main waves. The anarchist wave, which emerged in the late 19th and early 20th centuries, was followed by the ethnonationalism wave, which coincided with the post-colonial period. This included movements such as Irish republicanism and various African groups seeking independence from Belgium, France, Britain, Germany, and other colonial powers.

The third wave, which he referred to as the New Left, included groups like the Baader-Meinhof Gang in Germany, the Japanese Red Army, and the Brigate Rosse in Italy—organizations that pursued left-wing revolutionary causes.

We are currently in what he called the religious wave, which dates back to the late 1970s. Key events that shaped this wave include the Iranian Revolution in February 1979 and the Soviet invasion of Afghanistan, which eventually led to the formation of the Taliban and later Al-Qaeda.

Another critical but often overlooked event was the Grand Mosque Siege in Mecca in 1979. This event pushed the Saudi government to adopt an even more austere and fundamentalist interpretation of Islam, which was already highly conservative at the time. It played a crucial role in shaping the ideology of figures like Osama bin Laden and the rise of Al-Qaeda.

Now, the term wave should be used very loosely. We still see ethnonationalist terrorism today, even though its peak was in the mid-to-late 20th century. We still have anarchist terrorism. However, the dominant ideological driver of terrorism in 2025—and for nearly fifty years—has been Islamist terrorism, specifically jihadism.

This includes individuals and groups such as Al-Qaeda, ISIS (Islamic State), Al-Shabaab in Somalia, and many others who use a particular interpretation of Islam to justify violence. They aim to establish and impose their version of Islam on local populations while also targeting the West in retaliation for what they perceive as offences against Islam in the Middle East, South Asia, and Africa.

Jacobsen: Do many of these ideologies—regardless of Rapoport’s four waves—boil down to something akin to ideologies of resentment?

Gurski: One of the biggest challenges we face is defining ideology itself.

Let me give you an example. In the past four to five years, there has been growing concern in Canada and the United States—perhaps elsewhere as well—about so-called violent incels. Incels refer to involuntary celibates—men who feel entitled to relationships and, when rejected, become resentful and violent toward women.

Some argue that incel violence constitutes an ideology. I push back strongly against that idea. It is violent misogyny, plain and simple. These individuals hate women because women will not conform to their desires. This is no different from domestic violence, partner abuse, or other forms of misogynistic aggression.

So, we are left with the question: Is there enough structure in this belief system to constitute an ideology?

Canada’s Criminal Code further complicates the issue. While terrorism is legally defined under the Anti-Terrorism Act, passed after 9/11 in February 2002, the law refers to serious violence motivated by ideological, religious, or political causes. However, it does not define what constitutes an ideology.

One person’s ideology might be another person’s set of ideas. That distinction—or lack thereof—makes things incredibly complicated.

And to add to the confusion, consider the current U.S. president’s recent move to designate Mexican drug cartels as terrorist organizations. I strongly disagree with that classification. Criminal organizations like the Sinaloa Cartel have no ideology.

They are not committing violence for political or religious reasons. Their goal is profit—selling drugs, controlling territory, and intimidating local populations to facilitate their criminal enterprises. That is not ideological terrorism; it is organized crime.

I leave the term ideology itself to philosophers and political scientists to debate. However, I do not believe that anyone—whether academic or practitioner—has fully resolved the issue of how to define ideology in this context.

Jacobsen: And we may need some grounding here. What are the generally accepted consensus definitions of counterterrorism, counter-extremism, and their countermeasures?

Gurski: Yes. So, let’s start with the concept of “terrorism” itself.

There has to be an act of serious violence. People throw around terms like cyberterrorism, but that is not terrorism. If you take down a banking system, that is not terrorism. It is an inconvenience and may disrupt financial systems, but it does not meet the threshold of terrorism.

If you take out a SCADA (Supervisory Control and Data Acquisition) system disrupting electricity or water supply, that is serious. But even then, it is sabotage, not terrorism. It is an attempt to undermine a country’s infrastructure. For something to be classified as terrorism, violence has to be part of it—first and foremost.

It has to be a serious act of violence. Let me give you an example.

The so-called Freedom Convoy in Ottawa in February 2022. We all remember the scenes: 18-wheelers blocking Wellington Street in front of Parliament, crowds, shouting, demonstrations, rude signs—very un-Canadian behaviour, not saying sorry every fifteen seconds.

Some people in Ottawa called that terrorism. And I asked them, “Can you name a single act of violence that came out of the Freedom Convoy?” The answer was “no.”

Did they say mean things to people? Yes, probably. Because some of them were assholes, but that is not an act of violence. That is just being an asshole.

Of course, the government then invoked the Emergencies Act, which a federal court later ruled was illegal. The only legal justification for invoking the Emergencies Act is if CSIS determines that an individual or group threatens national security. And CSIS publicly stated that these protesters were not a threat to national security.

In their assessment, the Freedom Convoy organizers couldn’t organize a piss-up in a bar, let alone threaten the country. So, the government did not even have the legal foundation to justify invoking the act.

Terrorism has to be violent in nature. It can be the threat of violence or the actual use of violence. But it cannot be intimidation, personal revenge, or profit-driven crime. The violence must be carried out to advance a specific ideological, religious, or political goal.

That is, at its most basic, my definition of terrorism.

Jacobsen: Would you get pushback from others in your field?

Gurski: Oh, tons. Absolutely tons. Some would argue that certain criminal groups do have an ideology. To which I say, Great, show me the evidence.

Interestingly, there are acts of violence that are not labelled as terrorism when, by definition, they should be.

For example, take the church burnings in Canada a few years ago. In the aftermath of the mass graves story—graves that, by the way, have never been found—we saw over 300 churches burned across Canada.

Those were acts of terrorism, whether carried out by Indigenous activists, left-wing extremists, or other groups. The Criminal Code does not define terrorism as simply killing people. It includes serious acts of violence against significant property.

I would argue that burning down 300 churches is a significant act of violence against property. And yet, no one in government would ever dare call that terrorism. The prime minister said, “I don’t like it, but I understand it.”

Well, then you must understand 9/11, too. You may not like it, but you understand it. It’s ludicrous to take this series of violent acts and say, “Well, yes, it’s not terrorism.” There is a phrase you will never hear in Canada: First Nations terrorism.

It is inconvenient because of Truth and Reconciliation, and the list goes on if it occurs. With all these past injustices we are apologizing for, no one will call a spade a spade and label those acts as terrorism.

Jacobsen: What about the definition of extreme as a root word when discussing extremism itself? What is the threshold for extremism? 

Gurski: Again, it comes down to violence. Extreme, in and of itself, is not necessarily problematic.

All joking aside, I consider Toronto Maple Leafs fans extreme. They haven’t won the Stanley Cup since 1967—what is that? It’s been over half a century now. So, if you’re a Leafs fan—which I definitely am not—you are pretty extreme if you think they will win the Cup anytime soon.

Most social progress has come from extreme movements. Think of the fight for women’s rights—women chaining themselves to railings or throwing themselves in front of the king’s horse at the Epsom Derby in 1913—or the abolitionist movement against slavery. Those were extreme movements.

The French Revolution was also an extreme movement. It was violent, but I would argue it wasn’t purely political—though others might disagree. So, extremism itself is not the issue. It only becomes a problem when it involves the use of violence to advance a cause.

Some people, including myself, sometimes use violent extremism and terrorism as synonyms. They are identical but close enough to be used interchangeably in many contexts. As a journalist, you likely appreciate that—you don’t want to use the same word repeatedly. You want to vary your style and vocabulary. That’s why I tend to use violent extremism and terrorism synonymously when I write.

Jacobsen: If we establish this framework and aim to counter such acts, how do we take violence as the foundation and use it to identify and combat terrorist and extremist acts of a violent nature?

Gurski: It’s not easy. I’ll return to my days with CSIS—the Canadian Security Intelligence Service. CSIS has a lower threshold for investigative power than law enforcement. People don’t realize that in Canada. As a security intelligence agency, CSIS does not collect information to an evidentiary standard—it collects intelligence, not evidence. This means its findings cannot be used in Canadian courts, often leading to legal challenges.

CSIS operates on reasonable grounds to suspect, whereas law enforcement requires reasonable grounds to believe. These are different legal standards, which means that CSIS can investigate someone at an earlier stage.

So, if Scott posts content online that seems problematic, it falls within CSIS’s mandate to ask, “What’s Scott up to? Let’s take a look at what he’s posting. Where is he posting it? What is he saying?”

Sometimes, they’ll knock on your door and say, “Hey, Scott. Hi. We’re with CSIS. What the fuck are you doing online, buddy? Why are you posting this kind of stuff?”

The challenge, however, is that most people who post stupid things online never act on them in the real world. It’s easy to post online—people can do it anonymously through VPNs, encrypted messaging apps, or privacy-focused browsers like Brave. They can vent, troll, or role-play as extremists.

It only becomes problematic when someone is advocating or threatening the use of violence. But even then, most of those who post threats online are either cowards or incompetent and incapable of following through.

The real challenge for security services is determining who crosses the threshold into actual violence. In Canada, when a case becomes serious enough—when CSIS has credible concerns that someone is moving from words to action—it has a mechanism to hand off intelligence to the RCMP.

For example, CSIS might say to the RCMP, “We’ve been following Scott for a while. We’ve spoken to him. There’s been no change. It’s getting worse.” At that point, the RCMP could launch a criminal investigation: Is this behaviour a violation of the Criminal Code? Is he making violent threats, planning acts, or engaging in criminal conspiracy?

But there’s no simple formula for this, right? No checklist? There’s no algorithm that says if you exhibit signs 1 through 3, we won’t worry, but if you show signs 1 through 6, we act.

The first book I wrote, The Threat from Within (2015), examined signs of violent radicalization but made it clear that these are not predictors of violence. Someone can be radicalized without ever becoming violent.

That’s the real challenge for security intelligence and law enforcement. First, you can’t monitor everyone. Second, you can’t investigate everyone.

So, which cases are serious? Who are the genuine threats, and who are just online wankers who will never act on their words?

I wish there were a simple, plug-and-play model to determine this. Over the past 25 years, I’ve seen many threat assessment models. Some are decent, but none are predictive in nature. This comes down to individual decision-making—and no model can fully predict human behaviour.

Let me use a simple example. When I wake up in the morning, do I have cereal, yogurt, bacon, an egg, or a bagel? I can’t predict that in advance until I get into the kitchen and see what’s on the shelf. What do I feel like? It’s the same thing with violent radicalization.

You cannot predict which individual will wake up one day and decide; today is the day. I will grab a knife from the counter and walk into a kindergarten. We’ve seen that happen in England. I will get in my car and drive down Granville Street at noon. I’m going to attack a police officer inside Commonwealth Stadium. That happened in Edmonton in 2017—a man attacked a police officer. Then, he ran over pedestrians while carrying an ISIS flag on his dashboard.

You can’t predict these things. Look at the New Orleans attack on New Year’s Eve this past year—you couldn’t predict that either. Stopping these kinds of attacks is extremely difficult for security agencies.

License & Copyright

In-Sight Publishing by Scott Douglas Jacobsen is licensed under a Creative Commons Attribution-NonCommercial-NoDerivatives 4.0 International License. ©Scott Douglas Jacobsen and In-Sight Publishing 2012-Present. Unauthorized use or duplication of material without express permission from Scott Douglas Jacobsen strictly prohibited, excerpts and links must use full credit to Scott Douglas Jacobsen and In-Sight Publishing with direction to the original content.