The opinion of the court was delivered by: Jones, J.:
This opinion is uncorrected and subject to revision before publication in the New York Reports.
This appeal, involving litigation arising from the 1993 terrorist bombing incident in the parking garage of the World Trade Center complex (WTC), raises critical issues regarding the interplay of the proprietary and governmental functions of a public entity and the provision of security, particularly against the risk of terrorist attack. First, we must determine whether the Port Authority of New York and New Jersey (Port Authority) was performing a governmental or proprietary function in its provision of security at the premises. Second, if the Port Authority was engaged in such a governmental function, we must consider whether it exercised discretion in its security decision-making to entitle it to the common-law defense of governmental immunity. We hold that the Port Authority is entitled to the protection of governmental immunity.
The Port Authority is a public entity jointly created by a 1921 compact between New York and New Jersey to oversee and operate critical centers of commerce and trade, as well as transportation hubs such as ports, airports, bridges, and tunnels (see McKinney's Uncons Laws of NY § 6404).*fn1 The Port Authority is a financially self-reliant public entity that draws its revenue and income from fees generated by its various properties, and not from the tax revenue of either New York or New Jersey.
Among its properties, the WTC was a key facility developed, constructed, and operated by the Port Authority. The WTC was created through 1962 legislation "for the benefit of the people of the states of New York and New Jersey" (McKinney's Uncons Laws of NY § 6610) with "the single object of preserving . . . the economic well-being of the northern New Jersey-New York metropolitan area" (McKinney's Uncons Laws of NY § 6601 ).
Structurally, the WTC was comprised of seven high-rise buildings erected on a 16-acre site -- including the 110-story Twin Towers -- which housed offices and various commercial establishments such as a hotel and a concourse of shops and restaurants. In addition, the WTC served as a center for various federal and state government agencies including, for example, the United States Secret Service and the New York State Police, among others. The complex contained six subgrade levels, B-1 through B-6, with parking facilities located on levels B-1 through B-4, for Port Authority personnel, WTC tenants, and the public. 1,600 parking spaces were reserved for tenants and other WTC and Port Authority personnel, and 400 spaces were allotted for public parking by transient visitors.
The Port Authority employed a security force of 40 Port Authority police officers assigned on a full-time basis to a precinct located within the confines of the WTC. A second, separate contingent of officers was assigned to the PATH railroad station located within a subgrade level of the complex. In addition, numerous security personnel were deployed at the Port Authority's other facilities, tunnels, and bridges. The reserved parking, on levels B-2 through B-4, was patrolled routinely by Port Authority officers. Level B-1 was typically manned by civilian personnel with surveillance cameras trained on all the ramps leading to and from the parking garage. The Port Authority also retained, from 1989 to 1994, a separate, additional private force comprised of security guards employed by City Wide Security Services, Inc. These security guards patrolled the WTC, including the underground, subgrade levels.
Visitors essentially had unimpeded ingress and egress into the parking garage areas, but not the parking lot proper. For example, on the B-2 level, peripheral public parking areas were accessible as a driver would encounter a guard or gate only when entry was sought, from a ramp or roadway, into the parking lot itself. As such, a vehicle could be parked on an internal, underground roadway without actually entering a parking lot.
Starting in the early 1980s, the Port Authority engaged in exhaustive counter-terrorism planning and investigation. In 1983, as a member of both the New York State Terrorism Task Force and the FBI's Joint Terrorism Task Force, it obtained access to confidential information pertaining to security threats against Port Authority facilities. As a result, it implemented a "Terrorist Countermeasure Planning" initiative whereby the Port Authority was able to exchange vital security intelligence with various federal and state agencies. Pursuant to this initiative, it established security protocols and response mechanisms, including a threat level system, for all of its facilities.
In the early 1980s, the Executive Director of the Port Authority expressed concern with "the threat of terrorist  attacks on Port Authority facilities" due to "an emerging pattern in signs around the globe of terrorist attack." In 1984, an internal report entitled "Terrorist Assessment World Trade Center 1984" was circulated among the management of the Port Authority and it concluded that the WTC "should be considered a prime target for domestic as well as international terrorists." The WTC was a "high risk target" and its "parking lots [were] accessible to the public and  highly susceptible to car bombings."
Later that same year, the Port Authority created the Office of Special Planning ("OSP") to study and assess the "nature" and "dimension" of the security risks faced by all of its facilities, and ultimately, to recommend appropriate security measures. The OSP staff consisted of police and civilian employees of the Port Authority and worked in tandem with federal and state agencies such as the FBI, CIA, National Security Agency, State Police, and New York Police Department to evaluate security risks at all Port Authority facilities, including the WTC.
At the same time, the Port Authority retained an outside security consultant, Charles Schnalbolk Associates, to study the risk of a terrorist attack on the WTC. Schnalbolk's July 1985 report, entitled "Terrorist Threat Perspective and Proposed Response for the World Trade Center of the Port Authority of New York and New Jersey," advised that bombing attempts were "probable" and "the WTC is highly vulnerable through the parking lot." Schnalbolk identified the "parking lot, Concourse doors, [redacted]" as "highly vulnerable" such that "[w]ith little effort terrorists could create havoc without being seriously deterred by the current security measures." The report recommended, among other measures, that "[v]ehicles coming to the Port Authority parking areas may be screened for the presence of explosives" by inspecting trunks and undercarriages of cars. In a letter accompanying the report, Schnalbolk impressed upon the Port Authority the "urgent" need to implement "many or most" of the recommended security measures.
In mid-1985, the OSP issued a preliminary study entitled "WTC Study Brief," where it hypothesized various terrorist attack scenarios while assessing the specific vulnerabilities of the WTC. This preliminary report considered the possibility of a "[b]omb-laden truck attack" and that "[a] strategically positioned truck or van could cause extensive structural damage to the Trade Center as well as a large number of casualties." Among "[k]ey questions to be raised" were "[w]hat areas provide[d] the largest 'bang for the buck' for various amounts of explosives in a truck or van (e.g., across the street from the WTC; in the parking lot below the Trade Center, etc)."
In November 1985, the OSP issued a formal report entitled "Counter-Terrorism Perspectives: The World Trade Center" which addressed the threat of terrorism with respect to the entire WTC complex. The report theorized as "Option Nine" that a "time bomb-laden vehicle could be driven into the WTC and parked in the public parking area. The driver could then exit . . . At a predetermined time, the bomb could be exploded in the basement." The risk assessment section of the report stated that although "the real possibility of an incident occurring at the WTC does exist, . . . , it is not considered to be a high risk situation at present." Concomitantly, OSP concluded that "terrorist events," particularly car bombings in the parking garage were considered "low risk."
Within the same report, myriad recommendations were proffered on how to bolster security within the WTC. With respect to the parking garage, the idea of entirely eliminating public parking was advanced along with alternative measures such as manned entrances, restrictions on pedestrian access to parking area ramps, random vehicle inspections, and dog patrols. However, manned entrances were considered to be an ineffective deterrent; limits on pedestrian access were considered futile because the parking areas could still be accessed in other ways; and random vehicle inspections were deemed unconstitutional. Following the completion of the report, the Port Authority convened several meetings in 1986 to discuss the issue of transient public parking, among other safety concerns. These meetings were attended by high-level officials such as the Executive Director of the Port Authority; the Director of the World Trade Department; the Port Authority police; and other heads of law enforcement. Although some "sub-grade security checks" were implemented -- e.g., a full-time guard was stationed at the parking garage entrance on Barclay Street -- it was determined that the Port Authority would not eliminate public parking. Others concurred in that determination as the head of OSP testified at trial that the report "couldn't produce anything other than a low risk" of attack in the parking garage, and the Port Authority's head of police believed that the "risk, if anything, was extremely low."
After OSP issued its final report, the Port Authority hired an outside security consultant, Science Applications International Corporation ("SAIC"), to assess security issues and propose safety recommendations. An early report ranked the threat level at the WTC as "moderate to high" and envisioned a scenario where "[a] small delivery truck laden with several hundred pounds of explosive can be readily positioned on ramp G adjacent to the north meter room door and detonated following a short time delay to allow the driver's escape."
In its final report, "Physical Security Review of the World Trade Center," SAIC concluded that vehicle access to and from the subgrade levels was "for security purposes, uncontrolled" and the detonation of a "well-placed vehicle bomb" on Ramps A, B, E, F or G "would likely damage at least half of the support services (fresh water, steam, cooling water, electrical, and telephone) to the WTC users." The report considered the elimination of public parking, but did not recommend that as a security measure because it would be "very costly either in terms of operational impact, public acceptance, or monetary cost."
In 1991, following the Persian Gulf War, the Port Authority retained still another consulting firm, Burns and Roe Securacom, Inc., to assess threats to the WTC from an electrical engineering perspective. The firm issued two reports in March 1991 and December 1991 entitled "Vulnerability Study Electronic Engineering Security Review for The Port Authority of New York and New Jersey for The World Trade Center Complex" and "World Trade Center Complex Full Engineering Feasibility Study," respectively. In the latter report, Burns and Roe analyzed potentially vulnerable areas of the WTC using a scale of 0-350. The report identified public areas with high population density as the most vulnerable areas. For example, the public concourse was rated a 350 (the highest figure) and the plaza was assigned a 245. By contrast, the parking garage was assigned a 7 and the subgrade levels were considered low-risk areas.
As a result of these studies and evaluations, the Port Authority augmented its police and security force presence within the WTC, especially within high-population areas such as the concourse and plaza. With respect to the parking garage, the Port Authority installed surveillance cameras and door alarms, and increased lighting. Surveillance camera footage was routed to monitors manned by Port Authority personnel. By 1992, the Port Authority had also established security patrols encompassing the parking garage ramps and exterior roadways. A security guard with the title of "Truck Dock Coordinator" would survey the parking garage by golf cart, record the length of time vehicles were parked, and report any "suspicious or undesirable" vehicles. When presented with intelligence about a potential attack, the Port Authority heightened its security measures.*fn2
For example, in January 1993, the Port Authority received intelligence that an "office complex" within New York was a potential target of an attack due to turmoil in the Middle East. Consequently, the Port Authority and its police captain "reviewedwhat the protocols and procedures were and what our standard protocol would be to this kind of a threat." As a result, the Port Authority heightened security by increasing the number of patrols by its private security force, Port Authority police, and plainclothes detectives; establishing guard posts; and creating a vehicular blockade.
From 1983-1992, the WTC identified approximately 350 bomb threats or scares -- a "threat" included phone calls, letters, or verbal statements, and a "scare" related to situations where the risk of a bomb attack was imminent, such as the appearance of a suspicious package. None of these threats or scares involved a car or truck bomb in the parking garage, and only one instance involved a car bomb.*fn3 Of these threats, only two involved the parking garage.*fn4
On February 29, 1993, terrorists Ramzi Yousef and Eyad Ismoil*fn5 drove a rented van containing a fertilizer bomb into the B-2 level of the WTC parking garage. Without entering an actual parking lot, they parked the van on the side of one of the garage access ramps and lit the fuse on the bomb for a timed detonation to occur approximately 10 minutes later. Both men were able to enter and exit the parking garage area undetected. The resulting explosion, occurring at 12:18 p.m., created a blast crater six stories deep and killed six people, including four Port Authority employees.*fn6
648 plaintiffs commenced 174 actions against the Port Authority for injuries sustained as a result of the bombing. The actions were litigated jointly for some purposes and a Steering Committee was formed to oversee the litigation on behalf of some of the plaintiffs. The gravamen of the claims was a negligent failure by the Port Authority to provide adequate security --i.e., the failure to adopt the recommendations in the security reports; to restrict public access to the subgrade parking levels; to have an adequate security plan; to establish a manned checkpoint at the garage; to inspect vehicles; to have adequate security personnel; to employ recording devices concerning vehicles, operators, occupants, and pedestrians; and to investigate the possible consequences of a bombing within the WTC.
During pre-trial discovery, plaintiffs demanded the production of WTC security-related risk assessment reports obtained by the Port Authority, including any OSP reports and reports created by outside security consultants. The Port Authority, relying on the public interest privilege, objected to the broad disclosure of those documents, and argued that the production of those documents could expose any remaining vulnerabilities at the WTC. A Special Master conducted an in camera review of the security reports and determined that documents pertaining to the security risks of the parking garage should be disclosed while documents with respect to other Port Authority facilities should be withheld. Supreme Court adopted the Special Master's recommendations and ordered that some, but not all documents be disclosed, subject to a confidentiality order.
The Appellate Division modified, holding that the public interest privilege was not applicable and that all documents had to be disclosed, subject to a confidentiality order (Steering Comm. v Port Auth. [In re World Trade Ctr. Bombing Litig.], 248 AD2d 137, 137-138 [1st Dept 1998]). This Court reversed, holding that the Appellate Division's "matter-of-law rejection of the public interest privilege in the face of the legitimate concerns of the Port Authority [was] too sweeping" (Steering Comm. v Port Auth. [In re World Trade Ctr. Bombing Litig.], 93 NY2d 1, 9 ) and a fact-specific inquiry was needed to balance the concerns of the Port Authority (see id.). On remand, the Appellate Division affirmed Supreme Court's 1997 discovery ruling.
Following the completion of discovery, the Port Authority moved for summary judgment on grounds that it was entitled to the protection of governmental immunity and that the terrorist attack was not foreseeable as a matter of law. Supreme Court denied the motion, concluding that the negligent acts at issue stemmed from the Port Authority's proprietary capacity as a landowner, and not any exercise of a governmental function (In re World Trade Ctr. Bombing Litig., 3 Misc 3d 440, 466-467 [Sup Ct NY County 2004]). The Appellate Division affirmed without opinion (World Trade Ctr. Bombing Litig. Steering Comm. v Port Auth., 13 AD3d 66 [1st Dept 2004]).
In 2005, following a bifurcated trial solely on liability, a jury found that the Port Authority was liable for negligently failing to maintain the WTC parking garage in a reasonably safe condition. The jury apportioned 68% of the fault to the Port Authority and 32% to the terrorists. Supreme Court denied the Port Authority's motion to set aside the verdict.
The Appellate Division unanimously affirmed (51 AD3d 337 [1st Dept 2008]). With respect to the Port Authority's governmental immunity argument, the Appellate Division concluded that "the gravamen of this action is not that defendant failed properly to allocate government services to the public at large, but that it failed in its capacity as a commercial landlord to meet its basic proprietary obligation to its commercial tenants and invitees reasonably to secure its premises, specifically its public parking garage, against foreseeable criminal intrusion" (51 AD3d at 344). The Appellate Division also rejected the argument that plaintiffs had failed to show a likelihood of a terrorist attack, given the lack of a history of prior similar attacks at the WTC. The Appellate Division concluded that "the relevant requirement in premises liability actions is ultimately notice, not history" and that there was overwhelming record evidence that the Port Authority had notice that a car bombing could occur if security was not adequately addressed (see 51 AD3d at 345).
The parties returned to Supreme Court where they litigated damages separately in the various actions. Upon a jury verdict, Supreme Court awarded plaintiff-respondent Antonio Ruiz the total sum of $824,100.06. We granted the Port Authority leave to appeal, pursuant to CPLR 5602 (a)(1)(ii), from Supreme Court's judgment in the Ruiz action, bringing up for review the prior Appellate Division order as to Ruiz, and we now reverse.*fn7
As an initial matter, plaintiffs contend that the Port Authority is precluded from raising a governmental immunity argument because a statutory waiver of that defense serves as a dispositive threshold issue (see McKinney's Uncons Laws of NY §§ 7101 & 7106).
"Upon the concurrence of the state of New Jersey in accordance with section twelve hereof, the states of New York and New Jersey consent to suits, actions or proceedings of any form or nature at law, in equity or otherwise (including proceedings to enforce arbitration agreements) against the Port of New York Authority (hereinafter referred to as the "port authority"), and to appeals therefrom ...