Lithuania’s formation of a counter-terrorism institution after 9/11 sheds new light on three premises often associated with the study of institutional formation. First, while the distinction between the creation phase and the operation phase is logical, the appearance of extra-institutional guidance suggests that established institutions within other domains (e.g. military security) can temporarily fill an institutional vacuum (counter-terrorism). Second, the dynamic between agency and structure is readily seen, but in this case it was quite clear that agency was strongly dependent upon changes in some of the structural contexts (threat of terrorism, international institutions, age of the security state). Third, the role of sequencing and timing turned out to be more important than expected. There was a strong temporal order between the sequences of the formation phase and a significant spillover from two contemporary security processes (preparations for NATO membership, reforms of the security state).