The Transportation Security Administration would have us believe that those outrageous waits at airport checkpoints that made headlines recently were caused by a screener shortage or a surge in passengers. But there’s another reason for the crushing lines: a private contractor.

MorphoTrustUSA, in charge of scaling up the agency’s PreCheck fast-track lanes at airports around the country, is suing the federal government, a move that could prevent relief for millions of angry travelers.

Tens of thousands of travelers have missed their flights in recent months as wait times at checkpoints exceeded two hours at busy hubs in places like Chicago and Seattle. And there’s another pressing reason to fix the problem: big crowds at airports are potential targets for terrorists as recent attacks in Brussels, and now, Istanbul, have shown.

While Congress quickly gave TSA money to bring in reinforcements after lines spilled out of terminals, the fix that has the best chance of succeeding in the long run, experts say, is to get PreCheck enrollment into high gear.

MorphoTrust already has a contract with the TSA to bring millions of new members into PreCheck so they can keep their shoes on and their laptops stored as they whisk through security. But TSA believes that burden is too much for one company to handle and it’s been trying since 2013 to bring in more private sector vendors to join the effort to boost enrollments from 3 million today to 25 million by 2019, when 50 percent of all fliers would get the express treatment.

According to those familiar with the bidding process thus far, the aim is to make it as easy to sign up for PreCheck as it is to purchase a product online, while maintaining the integrity of the vetting process.

But since January, MorphoTrust has been fighting back.

First, the company filed what’s known as a “bid protest” that basically stopped TSA from issuing awards to more companies. When that protest was overruled by the TSA and the Government Accountability Office, MorphoTrust sued the government in federal claims court. While the legal process drags on, TSA is effectively blocked from issuing the new contracts and reaping the benefits this could bring.

“It is frankly bizarre,” said Robert Poole, director of transportation policy for the Reason Foundation, who has followed TSA since its inception after the 9/11 attacks. “It would be tragic for air travelers if this gets held up for another year or two.”

MorphoTrust, for its part, says the TSA is using “unlawful and irrational” methods to obtain new screening services, which, it says, it can already provide. It accused the agency of circumventing normal contracting procedures to evade scrutiny by Congress and the public, claiming that TSA’s plan is so flawed that it could open up new gaps in aviation security. TSA has until July 22 to respond to the charges, but it has already said publicly that it must get more help from the private sector and it can’t follow traditional contracting rules to do so.

MorphoTrust, a longtime provider of identity verification services, has $20 million in revenue at stake, according to its court filing. It’s owned by French tech and aerospace giant Safran.

Seven companies are reportedly competing for what TSA says will be at least three contracts. While TSA won’t release the names of the bidders, one of them is reportedly Clear, a private sector line-cutting service already has dedicated lanes for its membership plan at 13 U.S. airports. Delta Air Lines recently acquired a 5 percent stake in Clear, and it and other travel companies are getting increasingly impatient with the slow pace of progress.

“It is very frustrating,” said a source at a company that is in the running, who asked not to be named. “It is unfortunate that this monopolistic vendor is basically holding the U.S. traveling public hostage.”

MorphoTrust declined to comment on the details of the pending litigation but said through a spokesman: “Our protest doesn’t have anything to do with an objection to expansion; it is about a technical issue with the way the procurement was handled.” The spokesperson added that MorphoTrust is working to reduce a backlog in PreCheck applications and is adding dozens of enrollment centers not just in airports but in storefront locations like H&R Block offices.

MorphoTrust aside, several sources close to the situation, who requested anonymity due to the sensitivity of the subject, said that TSA shares much of the blame, for, among other things, taking too long to approve new enrollment centers and getting security clearances for employees manning them. Those are just two of a string of stumbles that led to the continuing fiasco at airport checkpoints.

A Delay Two Decades in the Making

The story dates back to the beginnings of TSA in 2001, when Congress mandated that the nascent agency establish a “trusted passenger” program to give low-risk travelers expedited treatment so screeners could focus their attention on fliers who might merit more scrutiny. For more than a decade TSA struggled with how to meet that goal, rolling out a series of failed schemes; they ranged from the comically ineffectual (“Black Diamond” lanes for “expert” travelers, dreamed up by a TSA chief who liked to ski) to the downright creepy, with a far-fetched plan to tap credit rating firms for personal information to establish a vast database on all passengers (who would be given “threat scores” for a good measure).

Finally, TSA in 2011 came up with PreCheck, which it believed would be less controversial since it was voluntary. The idea would be to give fliers who submitted to a background check and fingerprinting a sort of “screening lite” at airports that, like EZ Pass lanes at toll plazas, would make everything move more efficiently.

TSA didn’t have the resources to jumpstart the plan so it selected MorphoTrust to set up a network of enrollment services; after all, the company was working under contract with TSA, performing vetting services for things like a transportation worker ID program. Morpho’s role has been mainly a passive one: collecting the application forms and obtaining fingerprints, which are passed on to the TSA, so the data can be run through the FBI’s criminal background check apparatus.

TSA made its first blunder with PreCheck at inception by announcing a goal of having 25 percent of all air travelers using the speedy lanes by the end of 2013. It soon became clear that wasn’t going to happen: after an initial surge of interest, PreCheck enrollment proceeded at a desultory pace. Maybe it was the required in-person appearance at a TSA-approved center, or the $85 fee for five-year membership, but whatever the reason, sign-ups fell below expectations.

“This disastrous enrollment process is producing a chokepoint” that’s depriving millions of travelers of the benefits of PreCheck, said Kevin Mitchell, who heads the Business Travel Coalition. He added that these express security lanes produce on average three times the passenger throughput as regular security lines.

But TSA instead saw another way to reach that 25 percent goal: reel in passengers who were not part of PreCheck, but who popped up as low-risk in the routine assessments TSA gives to all passengers before flight time. (That’s under something called Secure Flight, which is why you provide your date of birth and exact legal name when you book a flight.) The number of people using the lines exploded by 300 percent.

“It was a fiasco,” Poole said, with clueless passengers clogging the lanes and slowing things down for everyone. And when an infamous 1970s terrorist, Sara Jane Olsen, was waved into a PreCheck lane by a screener (over objections from another TSA agent who recognized the former fugitive) this one too bit the dust.

TSA committed a far greater sin in December 2014 when it issued a formal request for proposals. Buried in the details was a request that bidders provide “risk scoring algorithms using commercial data, including social media and purchase information.” Many saw that as giving TSA and its surrogates carte blanche to scour the internet for personal, and potentially damning information. Privacy rights advocates pounced, and in February 2015, TSA issued a terse announcement withdrawing the bid request.

It took another eight months for TSA to issue a new one, which pointedly says that bidders will be barred from using any available social media for pre-screening efforts. Commercial databases, however, can be used, and that touches on what some observers say is a legitimate question as TSA struggles with the next step: What are these databases and how can one be assured the information they contain is accurate?

Chris Calabrese, senior policy director of the Center for Democracy and Technology, said in a letter to TSA that the enrollment expansion raises some serious privacy concerns.

“What will the public know about which data is ingested and how it is weighted?” he asked.

Poole said that another reason behind the delay is TSA’s own ingrained resistance to anything that could be perceived—fairly or not—as easing up on security.

“There are these factions within TSA that are opposed to going forward with this PreCheck expansion,” he said.

A source inside the aviation security sector put it more bluntly.

“It’s the CYA syndrome. If they’re dumbing this down, what if something happened? No one wants to have anything bad happen on their watch.” And for all TSA gets criticized for imposing a needless “security theater” travelers, thus far there has been no successful terror attack on a U.S. airplane since 9/11.

So where does this leave the millions of travelers facing absurdly long waits at checkpoints this summer? Unless TSA gets the technical help to enable many more people to sign up in more convenient locations like downtown shopping areas, or to complete more of the process online, it could take more than seven years to reach the target at the current pace.

Adding more staff on the frontlines has helped somewhat, but, according to the TSA’s crowd-sourced “My TSA” app, passengers recently were still posting waits of more than one hour at peak times at major airports. (TSA is reportedly working on a more accurate mechanism for disseminating real-time waits instead of relying on passengers to do so.)

Meanwhile, passengers should expect a long summer and then some.

In early June, when the agency’s chief, Peter Neffenger, testified before the Senate on how TSA was handling the epic waits at checkpoints, he referred to the ongoing request for bids and said he expected to award PreCheck enrollment contracts by the end of this year, six months later than the most recent deadline. And with a court decision on Morpho’s suit not expected before the middle of October—or later, if there’s an appeal—airports could be choked from Thanksgiving through Christmas and right on into next year.