Drawing on analysis of government records obtained using Access to Information Act (ATIA) requests, we examine policing and surveillance projects developed in preparation for three mega-events that recently took place in Canada Á the 2010 Winter Olympics, the G8/G20 meetings and a scheduled (but cancelled) North American Leaders Summit. Based on an investigation of 'Threat Assessment' reports produced between 2005 and 2010 by the Royal Canadian Mounted Police (RCMP) and the Canadian Security Intelligence Service (CSIS), we discuss transformations within Canada's anti-terror intelligence networks including the establishment of Integrated Security Units (ISUs) and the Integrated Threat Assessment Centre (ITAC) which resemble intelligence 'fusion centers' in the United States. These organisations became the knowledge-producing hubs for the classification and categorisation of national security threats. Examining shifts in ISU and ITAC Threat Assessments, we demonstrate how knowledge construction practices in security intelligence networks produce new categories of threat. Specifically, we focus on the newly constructed notion of 'multi issue extremism' (MIEs). Exploring the deployment of MIEs as a category of national security threat, we show how intelligence agencies have blurred the categories of terrorism, extremism and activism into an aggregate threat matrix.