Hitherto, political science has failed to answer a rather simple question: Why do some states provide high levels of airport security, while others fail to do so? Drawing upon a rational choice institutionalist framework, we compare airport security regimes in the US and Europe (in particular Germany) and show that the performance gap before September 11 can be largely attributed to institutional factors. In the US, responsibility was assigned to airlines, whose cost-cutting efforts resulted in lax controls. In Germany, the government shielded the provision of airport security from market pressures. We claim that delegation of responsibility for airport security to the government is a necessary, yet not a sufficient condition for a high security performance. Systems in which responsibility lies with private airlines are doomed to fail, since private markets are ill-equipped to provide a high security performance. While airlines have a long-term interest in safeguarding civil aviation, there exists both a time inconsistency and a collective cost problem that prevents sufficient investment in security in the short run. Thus, US policy-makers are well advised to resist the growing pressures for reprivatization and cost-cutting as well as to eliminate remaining flaws in the current federalized system.