OPINION OF THE COURT

JONES, J.

This appeal, involving litigation arising from the 1993 terrorist bombing incident in the parking garage of the World Trade Center complex (WTC), raises critical issues regarding the interplay of the proprietary and governmental functions of a public entity and the provision of security, particularly against the risk of terrorist attack. First, we must determine whether the Port Authority of New York and New Jersey (Port Authority) was performing a governmental or proprietary function in its provision of security at the premises. Second, if the Port Authority was engaged in such a governmental function, we must consider whether it exercised discretion in its security decision-making to entitle it to the common-law defense of governmental immunity. We hold that the Port Authority is entitled to the protection of governmental immunity.

I

The Port Authority is a public entity jointly created by a 1921 compact between New York and New Jersey to oversee and operate critical centers of commerce and trade, as well as transportation hubs such as ports, airports, bridges, and tunnels (see McKinney's Uncons Laws of NY § 6404 [L 1921, ch 154, § 1, as amended]).1 The Port Authority is a financially self-reliant public entity that draws its revenue and income from fees generated by its various properties, and not from the tax revenue of either New York or New Jersey.

Among its properties, the WTC was a key facility developed, constructed, and operated by the Port Authority. The WTC was created through 1962 legislation "for the benefit of the people of the states of New York and New Jersey" (McKinney's Uncons Laws of NY § 6610 [L 1962, ch 209, § 10]) with "the single object of preserving . . . the economic well-being of the northern New Jersey-New York metropolitan area" (McKinney's Uncons Laws of NY § 6601 [9] [L 1962, ch 209, § 1]).

Structurally, the WTC was comprised of seven high-rise buildings erected on a 16-acre site—including the 110-story Twin Towers—which housed offices and various commercial establishments such as a hotel and a concourse of shops and restaurants. In addition, the WTC served as a center for various federal and state government agencies including, for example, the United States Secret Service and the New York State Police, among others. The complex contained six subgrade levels, B-1 through B-6, with parking facilities located on levels B-1 through B-4 for Port Authority personnel, WTC tenants, and the public. Sixteen hundred parking spaces were reserved for tenants and other WTC and Port Authority personnel, and 400 spaces were allotted for public parking by transient visitors.

The Port Authority employed a security force of 40 Port Authority police officers assigned on a full-time basis to a precinct located within the confines of the WTC. A second, separate contingent of officers was assigned to the PATH railroad station located within a subgrade level of the complex. In addition, numerous security personnel were deployed at the Port Authority's other facilities, tunnels, and bridges. The reserved parking, on levels B-2 through B-4, was patrolled routinely by Port Authority officers. Level B-1 was typically manned by civilian personnel with surveillance cameras trained on all the ramps leading to and from the parking garage. The Port Authority also retained, from 1989 to 1994, a separate, additional private force comprised of security guards employed by City Wide Security Services, Inc. These security guards patrolled the WTC, including the underground, subgrade levels.

Visitors essentially had unimpeded ingress and egress into the parking garage areas, but not the parking lot proper. For example, on the B-2 level, peripheral public parking areas were accessible as a driver would encounter a guard or gate only when entry was sought, from a ramp or roadway, into the parking lot itself. As such, a vehicle could be parked on an internal, underground roadway without actually entering a parking lot.

Starting in the early 1980s, the Port Authority engaged in exhaustive counterterrorism planning and investigation. In 1983, as a member of both the New York State Terrorism Task Force and the FBI's Joint Terrorism Task Force, it obtained access to confidential information pertaining to security threats against Port Authority facilities. As a result, it implemented a "Terrorist Countermeasure Planning" initiative whereby the Port Authority was able to exchange vital security intelligence with various federal and state agencies. Pursuant to this initiative, it established security protocols and response mechanisms, including a threat level system, for all of its facilities.

In the early 1980s, the Executive Director of the Port Authority expressed concern with "the threat of terrorist[] attacks on Port Authority facilities" due to "an emerging pattern in signs around the globe of terrorist attack." In 1984, an internal report entitled "Terrorist Assessment World Trade Center 1984" was circulated among the management of the Port Authority and it concluded that the WTC "should be considered a prime target for domestic as well as international terrorists." The WTC was a "high risk target" and its "parking lots [were] accessible to the public and . . . highly susceptible to car bombings."

Later that same year, the Port Authority created the Office of Special Planning (OSP) to study and assess the "nature" and "dimension" of the security risks faced by all of its facilities, and ultimately, to recommend appropriate security measures. The OSP staff consisted of police and civilian employees of the Port Authority and worked in tandem with federal and state agencies such as the FBI, CIA, National Security Agency, State Police, and New York City Police Department to evaluate security risks at all Port Authority facilities, including the WTC.

At the same time, the Port Authority retained an outside security consultant, Charles Schnabolk Associates, to study the risk of a terrorist attack on the WTC. Schnabolk's July 1985 report, entitled "Terrorism Threat Perspective and Proposed Response for the World Trade Center of the Port Authority of New York & New Jersey," advised that bombing attempts were "probable" and "[t]he WTC is highly vulnerable through the parking lot." Schnabolk identified the "parking lot, Concourse doors, [redacted]" as "highly vulnerable" such that "[w]ith little effort terrorists could create havoc without being seriously deterred by the current security measures." The report recommended, among other measures, that "[v]ehicles coming to the Port Authority parking areas may be screened for the presence of explosives" by inspecting trunks and undercarriages of cars. In a letter accompanying the report, Schnabolk impressed upon the Port Authority the "urgent" need to implement "many or most" of the recommended security measures.

In mid-1985, the OSP issued a preliminary study entitled "WTC Study Brief," where it hypothesized various terrorist attack scenarios while assessing the specific vulnerabilities of the WTC. This preliminary report considered the possibility of a "[b]omb-laden truck attack" and that "[a] strategically positioned truck or van could cause extensive structural damage to the Trade Center as well as a large number of casualties." Among "[k]ey questions to be raised" were "[w]hat areas provide[d] the largest `bang for the buck' for various amounts of explosives in a truck or van (e.g., across the street from the WTC, in the parking lot below the Trade Center, etc.)."

In November 1985, the OSP issued a formal report entitled "Counter-Terrorism Perspectives: The World Trade Center" which addressed the threat of terrorism with respect to the entire WTC complex. The report theorized as "Option Nine" that a "time bomb-laden vehicle could be driven into the WTC and parked in the public parking area. The driver could then exit . . . At a predetermined time, the bomb could be exploded in the basement." The risk assessment section of the report stated that although "the real possibility of an incident occurring at the WTC does exist; . . . it is not considered to be a high risk situation at present." Concomitantly, OSP concluded that "terrorist events," particularly car bombings in the parking garage were considered "low risk."

Within the same report, myriad recommendations were proffered on how to bolster security within the WTC. With respect to the parking garage, the idea of entirely eliminating public parking was advanced along with alternative measures such as manned entrances, restrictions on pedestrian access to parking area ramps, random vehicle inspections, and dog patrols. However, manned entrances were considered to be an ineffective deterrent; limits on pedestrian access were considered futile because the parking areas could still be accessed in other ways; and random vehicle inspections were deemed unconstitutional. Following the completion of the report, the Port Authority convened several meetings in 1986 to discuss the issue of transient public parking, among other safety concerns. These meetings were attended by high-level officials such as the Executive Director of the Port Authority; the Director of the World Trade Department; the Port Authority police; and other heads of law enforcement. Although some "sub-grade security checks" were implemented—e.g., a full-time guard was stationed at the parking garage entrance on Barclay Street—it was determined that the Port Authority would not eliminate public parking. Others concurred in that determination as the head of OSP testified at trial that the report "couldn't produce anything other than a low risk" of attack in the parking garage, and the Port Authority's head of police believed that the "risk, if anything, was extremely low."

After OSP issued its final report, the Port Authority hired an outside security consultant, Science Applications International Corporation (SAIC), to assess security issues and propose safety recommendations. An early report ranked the threat level at the WTC as "moderate to high" and envisioned a scenario where "[a] small delivery truck laden with several hundred pounds of explosive can be readily positioned on ramp G adjacent to the north meter room door and detonated following a short time delay to allow the driver's escape."

In its final report, "Physical Security Review of the World Trade Center," SAIC concluded that vehicle access to and from the subgrade levels was "for security purposes, uncontrolled" and the detonation of a "well-placed vehicle bomb" on Ramps A, B, E, F or G "would likely damage at least half of the support services (fresh water, steam, cooling water, electrical, and telephone) to the WTC users." The report considered the elimination of public parking, but did not recommend that as a security measure because it would be "very costly either in terms of operational impact, public acceptance, or monetary cost."

In 1991, following the Persian Gulf War, the Port Authority retained still another consulting firm, Burns and Roe Securacom, Inc., to assess threats to the WTC from an electrical engineering perspective. The firm issued two reports in March 1991 and December 1991 entitled "Vulnerability Study Electronic Engineering Security Review for the Port Authority of New York and New Jersey for the World Trade Center Complex" and "World Trade Center Complex Full Engineering Feasibility Study," respectively. In the latter report, Burns and Roe analyzed potentially vulnerable areas of the WTC using a scale of 0-350. The report identified public areas with high population density as the most vulnerable areas. For example, the public concourse was rated a 350 (the highest figure) and the plaza was assigned a 245. By contrast, the parking garage was assigned a seven and the subgrade levels were considered low-risk areas.

As a result of these studies and evaluations, the Port Authority augmented its police and security force presence within the WTC, especially within high-population areas such as the concourse and plaza. With respect to the parking garage, the Port Authority installed surveillance cameras and door alarms, and increased lighting. Surveillance camera footage was routed to monitors manned by Port Authority personnel. By 1992, the Port Authority had also established security patrols encompassing the parking garage ramps and exterior roadways. A security guard with the title of "Truck Dock Coordinator" would survey the parking garage by golf cart, record the length of time vehicles were parked, and report any "suspicious or undesirable[]" vehicles. When presented with intelligence about a potential attack, the Port Authority heightened its security measures.2 For example, in January 1993, the Port Authority received intelligence that an "office complex" within New York was a potential target of an attack due to turmoil in the Middle East. Consequently, the Port Authority and its police captain "reviewed what the protocols and procedures were and what our standard protocol would be to this kind of a threat." As a result, the Port Authority heightened security by increasing the number of patrols by its private security force, Port Authority police, and plainclothes detectives; establishing guard posts; and creating a vehicular blockade.

From 1983-1992, the WTC identified approximately 350 bomb threats or scares—a "threat" included phone calls, letters, or verbal statements, and a "scare" related to situations where the risk of a bomb attack was imminent, such as the appearance of a suspicious package. None of these threats or scares involved a car or truck bomb in the parking garage, and only one instance involved a car bomb.3 Of these threats, only two involved the parking garage.4

On February 26, 1993, terrorists Ramzi Yousef and Eyad Ismoil5 drove a rented van containing a fertilizer bomb into the B-2 level of the WTC parking garage. Without entering an actual parking lot, they parked the van on the side of one of the garage access ramps and lit the fuse on the bomb for a timed detonation to occur approximately 10 minutes later. Both men were able to enter and exit the parking garage area undetected. The resulting explosion, occurring at 12:18 P.M., created a blast crater six stories deep and killed six people, including four Port Authority employees.6

II

Six hundred and forty-eight plaintiffs commenced 174 actions against the Port Authority for injuries sustained as a result of the bombing. The actions were litigated jointly for some purposes and a Steering Committee was formed to oversee the litigation on behalf of some of the plaintiffs. The gravamen of the claims was a negligent failure by the Port Authority to provide adequate security—i.e., the failure to adopt the recommendations in the security reports; to restrict public access to the subgrade parking levels; to have an adequate security plan; to establish a manned checkpoint at the garage; to inspect vehicles; to have adequate security personnel; to employ recording devices concerning vehicles, operators, occupants, and pedestrians; and to investigate the possible consequences of a bombing within the WTC.

During pretrial discovery, plaintiffs demanded the production of WTC security-related risk assessment reports obtained by the Port Authority, including any OSP reports and reports created by outside security consultants. The Port Authority, relying on the public interest privilege, objected to the broad disclosure of those documents, and argued that the production of those documents could expose any remaining vulnerabilities at the WTC. A Special Master conducted an in camera review of the security reports and determined that documents pertaining to the security risks of the parking garage should be disclosed while documents with respect to other Port Authority facilities should be withheld. Supreme Court adopted the Special Master's recommendations and ordered that some, but not all documents be disclosed, subject to a confidentiality order.

The Appellate Division modified, holding that the public interest privilege was not applicable and that all documents had to be disclosed, subject to a confidentiality order (Matter of World Trade Ctr. Bombing Litig., 248 A.D.2d 137, 137-138 [1st Dept 1998]). This Court reversed, holding that the Appellate Division's "matter-of-law rejection of the public interest privilege in the face of the legitimate concerns of the [Port Authority was] too sweeping" (Matter of World Trade Ctr. Bombing Litig., 93 N.Y.2d 1, 9 [1999]) and a fact-specific inquiry was needed to balance the concerns of the Port Authority (see id.). On remand, the Appellate Division affirmed Supreme Court's 1997 discovery ruling.

Following the completion of discovery, the Port Authority moved for summary judgment on grounds that it was entitled to the protection of governmental immunity and that the terrorist attack was not foreseeable as a matter of law. Supreme Court denied the motion, concluding that the negligent acts at issue stemmed from the Port Authority's proprietary capacity as a landowner, and not any exercise of a governmental function (Matter of World Trade Ctr. Bombing Litig., 3 Misc.3d 440, 466-467 [Sup Ct, NY County 2004]). The Appellate Division affirmed without opinion (Matter of World Trade Ctr. Bombing Litig., 13 A.D.3d 66 [1st Dept 2004]).

In 2005, following a bifurcated trial solely on liability, a jury found that the Port Authority was liable for negligently failing to maintain the WTC parking garage in a reasonably safe condition. The jury apportioned 68% of the fault to the Port Authority and 32% to the terrorists. Supreme Court denied the Port Authority's motion to set aside the verdict (2007 NY Slip Op 34467[U] [2007]).

The Appellate Division unanimously affirmed (51 A.D.3d 337 [1st Dept 2008]). With respect to the Port Authority's governmental immunity argument, the Appellate Division concluded that "the gravamen of this action is not that defendant failed properly to allocate government services to the public at large, but that it failed in its capacity as a commercial landlord to meet its basic proprietary obligation to its commercial tenants and invitees reasonably to secure its premises, specifically its public parking garage, against foreseeable criminal intrusion" (51 AD3d at 344). The Appellate Division also rejected the argument that plaintiffs had failed to show a likelihood of a terrorist attack, given the lack of a history of prior similar attacks at the WTC. The Appellate Division concluded that "the relevant requirement in premises liability actions is ultimately notice, not history" and that there was overwhelming record evidence that the Port Authority had notice that a car bombing could occur if security was not adequately addressed (see 51 AD3d at 345).

The parties returned to Supreme Court where they litigated damages separately in the various actions. Upon a jury verdict, Supreme Court awarded plaintiff-respondent Antonio Ruiz the total sum of $824,100.06. We granted the Port Authority leave to appeal, pursuant to CPLR 5602 (a) (1) (ii), from Supreme Court's judgment in the Ruiz action, bringing up for review the prior Appellate Division order as to Ruiz, and we now reverse.7

III

As an initial matter, plaintiffs contend that the Port Authority is precluded from raising a governmental immunity argument because a statutory waiver of that defense serves as a dispositive threshold issue (see McKinney's Uncons Laws of NY §§ 7101, 7106 [L 1950, ch 301, §§ 1, 6]).

Section 7101 provides that

Section 7106 provides that

Plaintiffs rely specifically on the highlighted language above to argue that section 7106 serves as a broad waiver of governmental immunity because the Legislature, through the plain language of the statute, acknowledged that the Port Authority performed governmental functions, but stripped it of any governmental cloak and immunity-based defenses.

It should be noted that there is, of course, a distinction between sovereign immunity and immunity-based defenses available to governmental agencies. Sovereign immunity is "the historic immunity derived from the State's status as a sovereign and protects the State from suit" (Brown v State of New York, 89 N.Y.2d 172, 192 [1996]), whereas governmental immunity, legislative immunity, or judicial immunity are defenses where "as a matter of policy, the courts have foreclosed liability" (id. at 192). Accordingly, the mere waiver of sovereign immunity does not preclude a governmental agency from asserting an immunity-based defense where appropriate. As explained in the Restatement (Second) of Torts:

As a matter of statutory construction, a court must "attempt to effectuate the intent of the Legislature" (Patrolmen's Benevolent Assn. of City of N.Y. v City of New York, 41 N.Y.2d 205, 208 [1976]) and "[w]here the terms of a statute are clear and unambiguous, `the court should construe it so as to give effect to the plain meaning of the words used'" (Matter of Auerbach v Board of Educ. of City School Dist. of City of N.Y., 86 N.Y.2d 198, 204 [1995], quoting Patrolmen's Benevolent Assn. of City of N.Y. v City of New York, 41 NY2d at 208). As such, if section 7106 clearly expresses a waiver of governmental immunity, then our inquiry must be foreclosed.

Here, a plain reading of section 7106 evinces a waiver of sovereign immunity, but there is no indication that the statute was meant to effectuate a concomitant, wholesale waiver of governmental immunity. The statute merely indicates that the waiver will have the intended effect of subjecting the Port Authority to lawsuit for claims sounding in tort. That this waiver treats the Port Authority like a private corporation does not have any unique significance beyond the waiver of sovereign immunity.

For comparison's sake, we may look, as an example, to Court of Claims Act § 8, a statute that undisputedly waives only the traditional sovereign immunity formerly enjoyed by the State of New York. That statute provides:

While it is uncontroverted that Court of Claims Act § 8 operates only as a waiver of sovereign immunity, it too employs language nearly identical to section 7106, treating the State as an "individual[] or corporation[]" with respect to tort liability. Such language, however, has never been considered to have the broad waiver effect plaintiffs propose.

In Weiss v Fote (7 N.Y.2d 579, 586-587 [1960]), the plaintiffs asserted that the language of the Court of Claims Act waived the defense of governmental immunity. This Court held that the "individual" and "corporation" language merely denoted that the State was relinquishing its sovereign status and would be subject to lawsuits like a private party. The Weiss Court further noted that, "[t]his is far different from saying, however, that the Court of Claims Act places the State on a parity with private corporations or individuals in respect of all of its defenses. Neither the language of the statute nor its tenor supports such a view" (id. at 587). We see no remarkable distinction between the language of Court of Claims Act § 8 and section 7106, and like the Weiss Court, conclude that there is no reasonable view that section 7106 serves to broadly waive the Port Authority's entitlement to a governmental immunity defense.

Plaintiffs direct us to Rittenhouse v A. Star Container Serv. (1988 WL 112898, 1988 US Dist LEXIS 11689 [SD NY 1988]) where the United States District Court for the Southern District of New York summarily held that section 7106 waived the Port Authority's entitlement to governmental immunity. This interpretation of New York State law is not binding on our Court, which has never before addressed the operative effect of section 7106. Further, we give no credence to plaintiffs' argument that the "sweeping coverage" of sections 7101 and 7106 waived the Port Authority's entitlement to governmental immunity (Trippe v Port of N.Y. Auth., 14 N.Y.2d 119, 124-125 [1964]).

In Trippe, this Court was asked to pass on the singular issue of whether a lawsuit arising from the taking of private property by the Port Authority was subject to the one-year limitation imposed for the commencement of a lawsuit against the Port Authority. We simply held that "the one-year limitation is mandatory as to all suits against the Port Authority" (id. at 123). We were not asked to address the effect of section 7106. The "sweeping coverage" language from Trippe referred to the Port Authority's waiver of sovereign immunity and consent to various types of lawsuits, not an overarching, additional waiver of governmental immunity (see id. at 124-125). Furthermore, the singular waiver of the Port Authority's sovereign immunity and its exposure to distinct lawsuits is evidenced by the statutory scheme of sections 7101 through 7106. For example, following the pronouncement in section 7101 of the waiver of sovereign immunity, the subsequent sections clearly specify the impact of such waiver on the Port Authority with respect to various causes of action.8 Therefore, contrary to plaintiffs' contention, section 7106 can be harmonized with section 7101 and is not rendered a nullity.

Plaintiffs also refer to the legislative history of section 7106 to argue that in 1950, civic entities such as the Citizens Union and the New York Board of Trade—frustrated by the commercial advantage enjoyed by the Port Authority because of its exemption from lawsuits—sought the enactment of section 7106. Plaintiffs identify some notations in the bill jacket for the statute that section 7106 is "an improvement which the Citizens Union has long advocated [and] [i]t will even be good for the Port Authority as it will remove public suspicion resulting from its present immunity" (Bill Jacket, L 1950, ch 301, at 3). However, the legislative history is consistent with the sole purpose of waiving the Port Authority's sovereign immunity and does not support plaintiffs' proposition. That the proponents of the legislation endeavored to remove the Port Authority's blanket exemption from lawsuit is a markedly different ambition than restricting its entitlement to present a defense. As such, plaintiffs cannot identify any other legislative history signaling an intent to deprive the Port Authority from asserting an immunity-based defense.

In sum, there is no express indication in the plain language of section 7106 that the statute was meant to preclude the Port Authority from asserting a governmental immunity defense, or any evidence in the legislative history evincing an intent of the Legislature to effect such an overarching waiver. Clearly, section 7106 does not operate to waive the Port Authority's entitlement to the common-law defense of governmental immunity.

IV

Having concluded that sections 7101 and 7106 of the Unconsolidated Laws of New York do not waive the Port Authority's right to assert a governmental immunity defense, we now turn to the crux of this appeal—whether the Port Authority's provision of security at the WTC was the performance of a governmental function or was that of a landlord. The Port Authority claims that by assessing security risks, allocating police resources, and implementing safeguards at the WTC in the face of numerous possible threats, it engaged in conduct akin to a governmental, rather than a proprietary, function. Accordingly, the Port Authority asks us to apply the governmental immunity doctrine to absolve it of tortious liability for the subject terrorist attack. On the other hand, plaintiffs maintain that the provision of security within the parking garage—a commercial area that served the commercial tenants of the WTC (as well as the public) and generated income—fell within the Port Authority's proprietary capacity. Therefore, the Port Authority is not entitled to governmental immunity and its alleged negligence must be reviewed pursuant to the common-law duties of a landowner (see e.g. Nallan v Helmsley-Spear, Inc., 50 N.Y.2d 507 [1980]). We find plaintiffs' arguments unavailing and hold that the Port Authority acted within its governmental capacity because its security operations at the WTC constituted police protection.

The difficulty in a case such as this—where a governmental entity performs dual proprietary and governmental functions—is in ascertaining the proper capacity in which the Port Authority's actions should be assessed.9 In Miller v State of New York (62 N.Y.2d 506, 511-512 [1984]), this Court explained that the functions of a governmental entity can be viewed along a "continuum of responsibility" ranging from the most basic proprietary obligation, like that of a private landlord, to the most complex governmental function, such as the provision of police protection.

Generally, when a governmental agency

The relevant inquiry in determining whether a governmental agency is acting within a governmental or proprietary capacity is to examine

As such, in light of the fact that the varied functions of a governmental entity can be interspersed with both governmental and proprietary elements, the determination of the primary capacity under which a governmental agency was acting turns solely on the acts or omissions claimed to have caused the injury. That is, we must now consider whether the precise failures for which the Port Authority was found liable were governmental or proprietary in nature.

The gravamen of plaintiffs' complaint alleges a failure to provide adequate security for the WTC. Specifically, Supreme Court summarized the plaintiffs' claims as:

While some of plaintiffs' claims may touch upon the proprietary obligations of a landlord, when scrutinizing the purported injury-causing acts or omissions, they allude to lapses in adequately examining the risk and nature of terrorist attack and adopting specifically recommended security protocols to deter terrorist intrusion. These actions are not separable from the Port Authority's provision of security at the WTC, as the dissent concludes; rather, they were a consequence of the Port Authority's mobilization of police resources for the exhaustive study of the risk of terrorist attack, the policy-based planning of effective counterterrorist strategy, and the consequent allocation of such resources. Thus, the ostensible acts or omissions for which plaintiffs seek to hold the Port Authority liable stem directly from its failure to allocate police resources (see Weiner, 55 NY2d at 182) as these failures lie, not within the safety measures that a reasonable landowner would implement, but within security operations featuring extensive counterterrorism planning and investigation that required discretionary decision-making with respect to the strategic allocation of police resources.

"The Port Authority is and of necessity has to be a State agency" (Whelan v Wagner, 4 N.Y.2d 575, 584 [1958]) and the Port Authority "shall be regarded as performing an essential governmental function in undertaking the effectuation [of the WTC], and in carrying out the provisions of law related thereto" (McKinney's Uncons Laws of NY § 6610 [L 1962, ch 209, § 10]). Police protection, particularly, is a quintessential example of a governmental function as it involves "the provision of a governmental service to protect the public generally from external hazards and particularly to control the activities of criminal wrongdoers" (Riss v City of New York, 22 N.Y.2d 579, 581 [1968]; see also Miller, 62 NY2d at 512; Bass v City of New York, 38 A.D.2d 407, 411 [2d Dept 1972]). But what distinguishes police protection from "a landowner[`s duty to] maintain[] his property in a reasonably safe condition in view of all the circumstances" (Miller, 62 NY2d at 513), is that it is "limited by the resources of the community and by a considered legislative-executive decision as to how those resources may be deployed" (Riss, 22 NY2d at 581-582). Indeed, in Weiner, the plaintiff— who was accosted by a stranger while in a subway station—alleged that the Transit Authority negligently failed in its proprietary capacity to either shutter the train station during late night hours or adequately police the area (55 NY2d at 180). This Court concluded that the failures were not proprietary, but derived from a governmental furnishment of police protection (id. at 181) as the implementation, or non-implementation, of security options such as providing police surveillance or closing the station during late night hours involved the exercise of discretion by the Transit Authority with respect to the allocation of police resources (id. at 182). An analogous situation is presented by this appeal.

Here, the Port Authority's general operating responsibilities at the WTC, like at its other facilities, necessarily included the provision of security for the premises as it was tasked with administering security measures to counter criminal activity (see Gasset v City of New York, 198 A.D.2d 12, 12 [1st Dept 1993]). This obligation was not limited to the benefit of commercial tenants and their customers, but extended to all who would avail themselves of the WTC facility.11 More significantly, the security planning was broad in scope as it also concentrated on the risk of terrorist attack, not just within the parking garage, but the entire premises. To guard against terrorism, police resources were deployed in the investigation of threats and the implementation of security measures. But, unlike the safety precautions required of every reasonable landowner, the Port Authority's security operations featured policy-based decision-making involving due consideration of pertinent factors such as the risk of harm, and the costs and benefits of pursuing a particular allocation of resources. As a result, the Port Authority placed police resources in priority areas deemed more susceptible to attack—i.e., the high-risk plaza and concourse rather than the low-risk parking garage.

A finding of police protection is supported by the record which is replete with evidence of extensive, strategic decisions and continuous security assessments. The Port Authority, which retains its own police force, constantly communicated with federal and state police agencies as a member of various security and anti-terrorism task forces, making it privy to sensitive, confidential intelligence and keeping it abreast of impending threats. The OSP, which included members of law enforcement, conducted internal investigations while commissioning various security reports to identify vulnerabilities and procure expert security recommendations. In response to these reports, the Port Authority's top security officials held meetings in conjunction with law enforcement to assess safety at the WTC, including the parking garage and the issue of transient parking. As a result, security was augmented and the Port Authority continued to monitor threats, taking specific responsive measures to credible warnings.

These responsibilities were more expansive and discretionary in nature than the "repair of steps or the maintenance of doors in an apartment building" deemed proprietary in Miller (62 NY2d at 511-512). To equate the broad scope of the Port Authority's security operations at the WTC with a proprietary responsibility belies the record. Our conclusion is also consistent with Miller which recognizes that "complex measures of safety and security for a greater area and populace" is more indicative of the performance of a governmental function (id. at 512). Accordingly, the breadth and nature of the Port Authority's responsibilities places its security-related conduct squarely within the ambit of governmental function.

Plaintiffs rely on Miller primarily for the proposition that this case involves proprietary responsibility. In that case, the plaintiff was a female student at SUNY Stony Brook who was attacked and raped within her dormitory by a third-party, non-student stranger who had entered the facility. Apparently, strangers and crime were not uncommon within the hallways, but the school failed to lock the dormitory's outer doors (id. at 509). Ultimately, this Court identified the failure to lock the outer doors as the injury-causing act or omission at issue and held that this was a proprietary function (id. at 513). Plaintiffs contend that the Port Authority similarly failed to undertake the safety precautions required of a reasonable landowner and thus, acted within a proprietary capacity. However, Miller acknowledges that greater, more intricate security measures may fall further along the governmental function portion of the continuum (id. at 514 ["This is not to say that further security measures relating to a particular dormitory or the entire campus might not be located so far along the continuum as to be beyond the scope of the State's duty as a landlord and constitute actions undertaken in its police protection capacity"]). Moreover, in a series of cases following Miller, this Court afforded governmental immunity where the conduct at issue involved the furnishing of police protection and the allocation of police resources, and not merely proprietary responsibility.

In Bonner v City of New York (73 N.Y.2d 930 [1989]), the plaintiff was a New York City public school teacher who was injured inside a playground by non-students who struck him with a baseball bat. The playground had been enclosed by a chain-link fence that included two gates, one of which could not properly lock because it was off its hinges. The assailants entered the playground through the unlocked gate. The plaintiff alleged that the City, in its capacity as a landowner, negligently failed to provide adequate security by allowing the gate to remain broken (id. at 932). Although the failure was seemingly proprietary in nature, this Court held that the negligence at issue fell within the City's governmental function because plaintiff's station at the gate was in accordance with prior instruction given upon the school's discretionary determination regarding that aspect of its overall security system. "[T]he provision of security against physical attacks by third parties in circumstances as are presented here, is a governmental function involving policymaking regarding the nature of the risks presented, and . . . no liability arises from the performance of such a function absent a special duty of protection" (id.; see also Doe v City of New York, 67 A.D.3d 854, 856 [2d Dept 2009]; Marilyn S. v City of New York, 134 A.D.2d 583, 585 [2d Dept 1987], affd for reasons stated therein 73 N.Y.2d 910, 912 [1989] [the court held that a New York City school's inadequate control and distribution of school room keys was not a proprietary responsibility, but a governmental function involving the provision of security against attacks from third parties]).

Furthermore, in Clinger v New York City Tr. Auth. (85 N.Y.2d 957, 959 [1995]), this Court held that the plaintiff's allegation that the defendant Transit Authority had failed "either to close the tunnel [where she was sexually assaulted] or to properly police it" was "overwhelmingly governmental in nature." Here, plaintiffs advance similar arguments that the Port Authority failed to close the parking garage or to guard against the risks posed by the permission of transient parking. Like Clinger, these arguments center on the allocation of police resources. We see no discernible difference between these cases and hence, reach the same conclusion.

The leanings of this Court's precedents in Weiner, Bonner and the other progeny of Miller, compel us to conclude that even when proprietary functions may be involved, if the essential nature of the governmental agency's injury-causing acts or omissions was a failure to provide security involving police resources—i.e., police protection—then a governmental function was being performed. The dissent argues that "in contrast to Bonner and Clinger, the decisions made by the Port Authority were made in its capacity as a landlord involved in the quintessentially private enterprise of running a parking garage in a major commercial building complex" (dissenting op at 465). However, when viewed narrowly, Bonner, Clinger and this case all superficially present solely proprietary responsibilities—i.e., failing to lock a gate or closing a subway tunnel. The touchstone that analogizes these cases is the authority of the public entities, after reasoned consideration, to opt (or not opt) for a certain configuration of security measures involving the allocation of finite police resources. That the WTC was primarily a commercial building complex or that the bombing incident pertained, in part, to security measures within the parking garage may implicate some proprietary responsibility, but it cannot overcome the governmental tenor of the security strategy established by the Port Authority to counteract terrorist intrusion.

V

The Port Authority's administration of security at the WTC involved discretionary decision-making. In Tango v Tulevech (61 N.Y.2d 34, 40 [1983]), this Court held that "when official action involves the exercise of discretion, the officer is not liable for the injurious consequences of that action even if resulting from negligence or malice." The governmental immunity doctrine recognizes that police protection is best left within the discretion of the governmental entity because, as discussed earlier, police resources are limited (Riss, 22 NY2d at 581-582). Given the finite nature of police resources, the mechanisms by which security and police protection is afforded cannot be dictated by the edict of a court or the retrospective conclusions of a jury. Police protection is best left in the hands of those most expert and qualified to render informed, deliberate decisions on implementing the most reasonable safeguards.

Often, the exercise of discretion with respect to the allocation of police resources involves reasoned consideration of varying alternatives. For example, while some of the security reports commissioned by the Port Authority appear facially damaging because they identified vulnerabilities12 within the parking garage and theorized that a car bombing could occur in the WTC garage, these reports rated the parking garage and subgrade levels as low-risk, especially in comparison to population-dense areas such as the concourse and plaza. Specifically, the OSP report and the Securacom, Inc. report (which rated the parking garage a low-risk grade of 7 out of 350) both indicated that other portions of the WTC presented higher risks of destruction to property and human life than the subgrade parking levels. Indeed, even the preliminary determination of which report to credit before implementing security measures was a decision that necessarily involved the exercise of discretion.

Plaintiffs contend that the risk of harm could have been obviated if the parking garage was closed to the public, but, as the head of OSP testified, "there were a lot of other considerations that would have to be taken into account" in making that determination. Port Authority officials credited the OSP report and concluded that security should be focused on other sectors of the WTC because the parking garage was a low-risk target. They also weighed the costs, benefits, and feasibility of various recommendations before ultimately concluding that the magnitude of the risk of harm of a terrorist attack at the concourse and plaza necessitated a greater concentration of the Port Authority's police resources in those areas than in the comparatively low-risk parking garage. Thus, the record evinces the type of informed, policy-based decision-making that entitles a governmental agency to immunity. The calamitous and harmful consequences of the 1993 terrorist bombing do not abrogate the principle that discretionary governmental acts may not be a basis of liability (see McLean v City of New York, 12 N.Y.3d 194, 203 [2009]).

Additionally, governmental immunity provides public entities with the latitude to operate without fear of legal reprisal for the injurious consequences of a particular course of action. In Laratro v City of New York (8 N.Y.3d 79, 81-82 [2006]) we explained that

Despite the injurious results of the instant terrorist attack, the policy of the governmental immunity doctrine seeks to promote the proactive, deliberate, and informed security procedures that were developed here. For example, the Port Authority solicited numerous expert opinions on the security risks and measures to be considered before allocating its police resources. While the Port Authority's decision-making could have proceeded along different acceptable paths of action, in this case, it reached a reasoned discretionary conclusion to heighten security in sectors of the WTC considered more susceptible to harmful attack. This is the type of assiduous behavior that governmental agencies should be encouraged to undertake in rendering informed decisions that involve the balancing of burdens and risks, competing interests, and allocation of resources. To hold otherwise would create a disincentive for governmental agencies to investigate these types of security threats. And to expose the Port Authority to liability because in the clarity of hindsight its discretionary determinations resulted in harm would engender a chilling effect on government and dissuade public entities from investigating security threats and exercising their discretion, especially in a time when the risk of terrorist attack is more apparent than ever before. As this Court has emphasized previously:

VI

In sum, we are compelled to hold in favor of the Port Authority because our precedent dictates that the provision of security for the benefit of a greater populace involving the allocation of police resources constitutes the performance of a governmental function.13 While the instant terrorist bombing occurred within the parking garage and may focus some attention on proprietary responsibility, the Port Authority's police resources were devoted to countering criminal incidents for the benefit of all who visited the WTC. Any failure to secure the parking garage against terrorist attack predominantly derives from a failed allocation of police resources and thus, this case is analogous to Weiner and the Miller progeny.

Further, the governmental immunity doctrine requires us to find the Port Authority insulated from tortious liability. Our courts simply cannot ignore that this policy-based doctrine is intended to afford deference to the exercise of discretion by the officials of municipalities and governmental entities, especially with respect to security measures and the deployment of limited police resources. Governmental entities cannot be expected to be absolute, infallible guarantors of public safety, but in order to encourage them to engage in the affirmative conduct of diligently investigating security vulnerabilities and implementing appropriate safeguards, they must be provided with the latitude to render those critical decisions without threat of legal repercussion.

The judgment appealed from and the order of the Appellate Division brought up for review should be reversed, with costs, and the complaint of plaintiff Antonio Ruiz dismissed.

CIPARICK, J. (dissenting).

On February 26, 1993, terrorists detonated a powerful car bomb in the subterranean parking area of the World Trade Center (WTC). Our Court has been charged with determining whether defendant the Port Authority of New York and New Jersey (Port Authority), which owned and operated the WTC, can be liable for negligently failing to provide adequate security in the subterranean garage. I conclude that the Port Authority's status as a government entity does not shield it from liability because the alleged negligence stemmed from proprietary activities taken in its capacity as a commercial landlord. I therefore respectfully dissent. And since the evidence presented at trial was sufficient to support the jury's finding of liability and the Port Authority's challenge to the jury's apportionment of fault is beyond this Court's further review power, I would affirm the order of the Appellate Division sustaining the verdict.

I.

The Port Authority is an interstate agency formed in 1921 by New York and New Jersey to "better co-ordinat[e] . . . the terminal, transportation and other facilities of commerce in, about and through the port of New York" (McKinney's Uncons Laws of NY § 6401 [L 1921, ch 154, § 1]; see also Matter of World Trade Ctr. Bombing Litig., 93 N.Y.2d 1, 5 [1999] [WTC Litig.]). It has authority over the New York City metropolitan area's three major airports, interstate bridges and tunnels, bus terminals, ports, the Port Authority Trans-Hudson (PATH) rail system and various other facilities (see WTC Litig., 93 NY2d at 5; Matter of World Trade Ctr. Bombing Litig., 3 Misc.3d 440, 443 [Sup Ct, NY County 2004] [WTC Litig.]).

In 1962, the State Legislature authorized the creation of the WTC as part of a development project that would "unif[y], at a single, centrally located site, . . . the principal New York terminal of the . . . interurban electric railway and a facility of commerce" (McKinney's Uncons Laws of NY § 6601 [7] [L 1962, ch 209, § 1]). The project's purpose was to "preserve and protect the position of the port of New York as the nation's leading gateway for world commerce" (McKinney's Uncons Laws of NY § 6601 [5]) and "preserv[e] . . . the economic well-being of the northern New Jersey-New York metropolitan area" (McKinney's Uncons Laws of NY § 6601 [9]). The WTC itself was the "portion of [this project] constituting a facility of commerce," and was defined to include any part not "devoted primarily to railroad functions, activities or services or to functions, activities or services for railroad passengers, notwithstanding that [parts of it might] not be devoted to purposes of the port development project other than the production of incidental revenue" (McKinney's Uncons Laws of NY § 6602 [L 1962, ch 209, § 2, as amended]). Construction began in 1966 and the first tenants arrived in 1970.

The WTC complex eventually consisted of seven buildings on 16 acres—the two iconic office towers, a third large office tower, two smaller office buildings, a United States Custom House and a hotel. The complex contained 12 million square feet of rentable office space, and over 50 retail stores, restaurants and other services. Most of the structures, including the twin towers, were situated around a central plaza. Underneath the plaza was a concourse with shops and restaurants. Below the concourse were six sublevels containing, among other things, tenant storage, truck loading docks, maintenance facilities, the PATH terminal, communication systems, emergency generators, power lines and tenant and public parking.

The sublevel parking facility had 1,600 tenant parking spaces and 400 spaces for the public. The public accessed parking on the B-2 level through two vehicle entry ramps and exited by two other ramps. The entrance ramps were not manned, although there was a ticket office operated by a parking manager. A separate truck entrance had a gate and guard post.

The WTC was managed by the Port Authority's World Trade Department, a management team that maintained security personnel separate from, and not responsible to, the Port Authority Police. The civilian security detail monitored the complex, reported accidents and intruders to the police and provided directions to the public. The Port Authority Police also maintained a presence at the WTC, including a command post on one of the sublevels, and were responsible for public safety, criminal investigations and accidents. None of the civilian security guards were assigned to the subgrade area. Only a single Port Authority Police Officer patrolled the subgrade areas.

As indicated by the majority, from the mid-1980s until the attack in 1993, the Port Authority commissioned a series of studies to assess potential security risks at the WTC, including the risk of terrorist attacks. It appears that these types of security reviews were not uncommon for commercial landlords—the record indicates that independent security consultants were hired by other large private commercial landlords, such as the operators of the Fox Plaza in Los Angeles and the Prudential Center in Boston, to make similar risk assessments during the same period. In the course of these security reviews, the Port Authority was repeatedly warned by internal and external security experts that this open, relatively unguarded parking area posed a security risk. As early as 1984, a report prepared at the Port Authority Police Superintendent's request described the WTC as "a prime target for . . . terrorists," and that an attack of this nature could have "catastrophic" results. In the summer of 1984, the Port Authority's executive director traveled to England and discussed anti-terrorism strategy with London's Metropolitan Police—Scotland Yard. On his return, he circulated a memo noting that "[t]hey are appalled to hear we had transient parking directly underneath the towers at a facility like the [WTC]."

That same year, the Port Authority created the Office for Special Planning (OSP), a combined civilian and police unit in the Port Authority's Public Safety Department, to assess and respond to the threat of terrorism at its facilities. In a preliminary "Study Brief," OSP observed that "[g]iven the recent truck bombings in Lebanon, it is important to consider the potential impact of such an attack on the WTC. A strategically positioned truck or van could cause extensive structural damage to the [WTC] as well as a large number of casualties."

While the OSP was working on its WTC report, the Port Authority hired a consultant, Charles Schnabolk, to prepare a report on the WTC's vulnerability to terrorism. His 1985 report noted that a bombing attempt at the WTC was "probable," and that the facility was "highly vulnerable through the parking lot." It found that "[t]he parking area need[ed] better surveillance" and recommended the installation of security cameras and ground mirrors. It also suggested that trunks and the undersides of vehicles entering the garage be inspected for explosives.

Later that year, the OSP issued its WTC counterterrorism report. It warned that the WTC complex had the "classic elements" of a terrorist target, particularly because of its great symbolic value, and that "[p]arking for 2,000 vehicles in the underground areas presents an enormous opportunity . . . for terrorists to park an explosive filled vehicle that could affect vulnerable areas." It described the WTC's public parking as "a definite security risk in that explosives may be readily concealed within a vehicle and parked within the core of the complex" and concluded that there was "ample justification to take decisive target hardening measures in this area." The report recommended eliminating public parking altogether. It also made less severe "compromise" suggestions, including posting guards at garage entrances, subjecting vehicles to random inspection and having the Port Authority Police frequently patrol the public parking area with explosive-detecting dogs. Port Authority leadership declined to adopt these recommendations, citing concerns about inconvenience to tenants, the constitutionality of random searches and the potential loss of revenue.

In 1986, the Port Authority hired another security consultant, Science Applications International Corporation (SAIC), to evaluate and prioritize WTC security risks. That report determined that the WTC support systems were vulnerable to an attack from the vehicle ramps in the subgrade parking area: "[a] well-placed vehicle bomb . . . would likely damage at least half of the support services (fresh water, steam, cooling water, electrical, and telephone) to the WTC users." The report described a possible "attack scenario" in which the detonations of a truck bomb on one of the garage ramps could cause extreme damage. It therefore suggested installing barriers across the vehicle ramps, eliminating public parking and conducting searches of vehicles prior to granting them access to the parking area. The report recognized that these recommendations were "very costly" in terms of "operational impact." The Port Authority rejected these recommendations.

In 1991, concerned about domestic terrorism in the wake of the Gulf War, the Port Authority hired yet another consulting firm, Burns and Roe Securacom, Inc., to evaluate the WTC's exposure to terrorist activities. According to a Securacom employee's trial testimony, the report's authors emphasized that the parking garage created "a potential" for a vehicle bombing and expressed this concern at various meetings with the Port Authority. The Port Authority took no significant action to address the risks associated with the garage that had been repeatedly identified by its own security experts.1

These long-standing concerns regarding the parking garage's vulnerability, tragically, proved well-founded when the terrorists drove a rented van filled with explosives into the public parking area of the B-2 level of the garage, parked it on one of the garage ramps, lit the fuse and left the facility. The bomb detonated approximately 10 minutes later, killing six people, injuring many others and impairing services to tenants. Some of those injuries gave rise to this complex litigation in which plaintiffs alleged that the Port Authority had failed to maintain the garage in a reasonably secure condition since it had, among other things, failed to adopt the various expert security recommendations; failed to restrict public access to the garage; failed to subject vehicles to inspection; and failed to have a manned checkpoint at the garage entrance with adequate security personnel or adequate electronic surveillance.

Following discovery, the Port Authority moved for summary judgment dismissing plaintiffs' claims. Supreme Court denied the motion, finding that there were triable issues of fact. Relevant to this controversy, the court rejected the argument that, based on language included in statutes waiving sovereign immunity (McKinney's Uncons Laws §§ 7101, 7106 [L 1950, ch 301, §§ 1, 6]), the Port Authority had also waived the right to assert a governmental immunity defense. That being said, the court determined that the Port Authority owed a duty to plaintiffs arising out of its obligations as a commercial landlord and could not rely on the shield of governmental immunity because its alleged negligence in "failing to close or provide adequate security in the WTC parking garage . . . involve[d] proprietary functions" (WTC Litig., 3 Misc 3d at 460). However, "[t]o the extent that any of plaintiffs' allegations . . . could be construed as the failure to have more Port Authority Police patrolling"—a purely governmental function—the court dismissed those allegations (id. at 466). Supreme Court also rejected the Port Authority's argument that the bombing was unforeseeable as a matter of law, noting that foreseeability is generally within the province of the trier of fact. The Appellate Division unanimously "affirmed for the reasons stated" by Supreme Court (Matter of World Trade Ctr. Bombing Litig., 13 A.D.3d 66 [1st Dept 2004] [WTC Litig.]).

At the subsequent liability trial, the jury found that the Port Authority had been "negligent by not maintaining the . . . garage in a reasonably safe condition," and that this negligence was a "substantial factor" in "permitting" the bombing, apportioning fault between the Port Authority and the bombers (2007 NY Slip Op 34467[U], *3, 4 [2007]). Supreme Court denied the Port Authority's motion to set aside the liability verdict and held that plaintiffs' evidence was legally sufficient to permit the jury to find liability. It also concluded that the jury charge and verdict sheet did not erroneously instruct the jury to apply a reasonable care, rather than a "minimal security measures," standard, and declined to disturb the apportionment of fault. The Appellate Division affirmed, reaffirming its prior conclusion that the Port Authority was not entitled to governmental immunity and holding that there was legally sufficient evidence that the Port Authority breached its duty as a landlord to protect those on its premises from third-party criminal conduct. Further, that court declined to exercise its authority to set aside the jury's apportionment of fault as against the weight of the evidence (see Nash v Port Auth. of N.Y. & N.J., 51 A.D.3d 337, 344-353 [1st Dept 2008] [WTC Litig.]).

Following the Appellate Division's affirmance of the liability ruling, one of the plaintiffs involved in the liability trial— plaintiff Antonio Ruiz—proceeded to trial on the issue of damages. Supreme Court entered judgment in favor of Ruiz for a total amount of $824,100.06 and we granted the Port Authority leave to appeal from the judgment (15 N.Y.3d 708 [2010]), bringing up for review the prior Appellate Division order rejecting the Port Authority's governmental immunity defense.

II.

The Port Authority first contends that any negligent security decisions it made were inherently governmental thereby shielding it from liability under the governmental immunity doctrine. The majority agrees that governmental immunity precludes recovery here but I believe the majority has misconstrued our jurisprudence in this arena. Plaintiffs are not claiming that the Port Authority failed to protect the public generally, but rather that it failed to meet discrete obligations it owed its tenants and invitees as the landlord of a commercial office complex.

As an initial matter, there is no dispute that the Port Authority is a government entity and is therefore entitled to sovereign immunity except to the extent waived by statute (see Trippe v Port of N.Y. Auth., 14 N.Y.2d 119, 123 [1964]). There is also no dispute that this sovereign immunity has been statutorily waived. Moreover, I concur with the majority's conclusion that McKinney's Unconsolidated Laws of NY §§ 7101 and 7106 only "evince[ ] a waiver of sovereign immunity" and "that the statute[s were not] meant to effectuate a concomitant, wholesale waiver of governmental immunity" (majority op at 443). Indeed, it is clear that the governmental immunity the Port Authority currently asserts here is doctrinally separate from the sovereign immunity waived by sections 7101 and 7106 (see Riss v City of New York, 22 N.Y.2d 579, 581-582 [1968]). Technically speaking, it is not immunity, but a defense that State entities may assert "to avoid paying damages for some tortious conduct because, as a matter of policy, the courts have foreclosed liability" (Brown v State of New York, 89 N.Y.2d 172, 192 [1996]).

I do not, however, share the majority's view that the Port Authority is entitled to the defense of governmental immunity under the facts of this case as the acts and omissions complained of relating to the failure to provide adequate security in the public parking garage arise from activities traditionally carried out by private commercial landlords. Under the governmental immunity doctrine, an agency of government is not liable for the negligent performance of a governmental function that involves the exercise of discretionary acts. A narrow exception applies when the negligence relates to a ministerial act, but only if "there existed `a special duty to the injured person, in contrast to a general duty owed to the public'" (McLean v City of New York, 12 N.Y.3d 194, 199 [2009], quoting Garrett v Holiday Inns, 58 N.Y.2d 253, 261 [1983]; see Lauer v City of New York, 95 N.Y.2d 95 [2000]; Tango v Tulevech, 61 N.Y.2d 34 [1983]).

This immunity is available only if the State entity is performing a government function. "[W]hen the State acts in a proprietary capacity as a landlord, it is subject to the same principles of tort law as is a private landlord" (Miller v State of New York, 62 N.Y.2d 506, 511 [1984]). By assuming a traditionally private role, the State assumes individualized and specific responsibilities that are distinct from its broad obligations to the populace as a whole (see Riss, 22 NY2d at 581). Even when acting as a landlord, however, a "[p]ublic entit[y] remain[s] immune from negligence claims arising out of the performance of [its] governmental functions, including police protection" (Miller, 62 NY2d at 510; see also Price v New York City Hous. Auth., 92 N.Y.2d 553, 557-558 [1998]; Weiner v Metropolitan Transp. Auth., 55 N.Y.2d 175, 180-181 [1982]). In other words, a State entity often has a "dual role" as sovereign and landlord over property it controls (Miller, 62 NY2d at 511). "[T]he State may act in its proprietary capacity as a landlord by virtue of its ownership of and control over a public facility and at the same time act in its governmental capacity by providing police protection to maintain law and order at that facility" (Sebastian v State of New York, 93 N.Y.2d 790, 793-794 [1999]). Thus, "a governmental entity which is a landlord is distinguishable from a private landlord, which would remain liable for the negligent performance of a security force it retained for the safety of its tenants" (Miller, 62 NY2d at 513).

Although some security measures are part of the State's obligation to provide police protection to the general public, a governmental entity may assume additional and separate obligations as a landlord. The difficulty lies in determining where to draw the line between police protection and proprietary security measures (see id. at 511). Acknowledging the fact-specific nature of this distinction, we have declined to sharply delineate the scope of a State entity's proprietary responsibility for security. Instead, in Miller, we established that "[a] governmental entity's conduct may fall along a continuum of responsibility to individuals and society deriving from its governmental and proprietary functions" (id. at 511-512). At one end of the continuum are simple security measures "directly concerning a piece of property for which the entity acting as landlord has a certain duty of care, for example, the repair of steps or the maintenance of doors in an apartment building" (id. at 512). From there, "[t]he spectrum extends gradually out to more complex measures of safety and security for a greater area and populace, whereupon the actions increasingly, and at a certain point only, involve governmental functions, for example, the maintenance of general police and fire protection" (id.).

When determining whether an action is governmental or proprietary, we look to "the specific act or omission out of which the injury is claimed to have arisen and the capacity in which that act or failure to act occurred" (id. at 513, quoting Weiner, 55 NY2d at 182). The Miller continuum therefore considers both the nature of the action at issue—ranging from the simplicity of a door lock to the complexity of police patrol—and the extent to which provision of that type of security measure is traditionally a governmental concern.

In Miller, we noted that "[o]wnership and care relating to buildings with tenants has traditionally been carried on through private enterprise ... and thus constitutes a proprietary function when performed by the State" (62 NY2d at 513). The action for which the State was found liable—a failure to lock the outer doors of a dormitory—was straightforward and sitespecific, thereby falling within this proprietary duty as it involved simple "physical security devices" (id. at 508) for the protection of a limited number of people towards whom the state had assumed the private role of landlord (see id. at 509-510).2

In considering where on the Miller continuum the Port Authority's conduct in this case falls, it is important to emphasize that the WTC was a predominantly commercial venture. Indeed, it is described by the governing statute as "a facility of commerce" (McKinney's Uncons Laws of NY § 6602 [L 1962, ch 209, § 2, as amended]). It contained 12 million square feet of rentable office space, which was almost totally occupied by private tenants, together with over 50 shops, restaurants and other services. Parking was available in the garage for the purpose of accommodating these tenants and the existence of public parking for visitors and potential customers naturally increased the retail value of the commercial space. Moreover, the Port Authority's security decisions regarding the garage were made by civilian managers, not law enforcement or security authorities, and stemmed from commercial concerns such as a desire to accommodate tenants and avoid inconveniencing visitors. In short, the Port Authority engaged in decision-making as a proprietary landlord when it decided not to adopt additional garage security measures.

In contrast to the approach taken by the majority, in my view it is essential to consider the precise failures for which the jury found the Port Authority liable. These are relatively common, site-specific measures, such as the failure to install barriers to the garage entrance, to provide a manned ticket booth, to install adequate electronic surveillance devices, or to restrict garage access to tenants only. In fact, Supreme Court explicitly dismissed plaintiffs' claims "[t]o the extent that any of plaintiffs' allegations ... could be construed as the failure to have more Port Authority Police patrolling the WTC garage" (WTC Litig., 3 Misc 3d at 466). Supreme Court correctly decided, and the Appellate Division appropriately affirmed, that although the Port Authority could not be liable for decisions it made regarding the deployment of its police personnel, it could be liable for failing to take other basic security measures that would be expected of any private landlord of a large commercial building.

The majority misreads my analysis, contending that I believe "the Port Authority is not entitled to governmental immunity simply because it was generally engaged in proprietary activity at the WTC" (majority op at 447 n 10). Rather, I actually agree with the majority that there are actions for which the Port Authority could not be liable at the WTC. For example, it could not be liable for how it chose to deploy the Port Authority Police. The Port Authority argues that the omissions for which it was found liable involved police protection, and it analogizes this case to others in which we have found that government agencies are immune from liability for failing to provide better security in a public school yard (see Bonner, 73 NY2d at 932-933) or failing to close or provide better security in a New York City subway access tunnel (see Clinger v New York City Tr. Auth., 85 N.Y.2d 957 [1995]). But the Port Authority was not found liable for negligently allocating police resources, but rather for its failure to take other reasonable measures to secure a commercial parking garage at a particularly vulnerable location. Indeed, Miller commands that we consider "the capacity in which [the negligent] act or failure to act occurred" (id. at 513). And here, in contrast to Bonner and Clinger, the decisions made by the Port Authority were made in its capacity as a landlord involved in the quintessentially private enterprise of running a parking garage in a major commercial building complex that was operated for profit. As a result, the Port Authority's governmental immunity with respect to garage security was far narrower than its immunity in making security decisions for other property and facilities where it was engaged in more traditional governmental functions, like airports or bridges.

To be sure, the Miller continuum lacks the clarity of a brightline rule and there will inevitably be difficulty in categorizing cases. Traditional governmental enterprises are often interspersed with traditionally private ones—airports, for example, have ample commercial space.3 But that is precisely why, as we emphasized in Miller, "any issue relating to the safety or security of an individual claimant must be carefully scrutinized to determine the point along the continuum that the State's alleged negligent action falls into, either a proprietary or governmental category" (62 NY2d at 512). Based on the specific facts presented in this case, the acts and omissions for which the Port Authority was found liable fall on the proprietary end of the spectrum. Simply put, the alleged security deficiencies did not, as the Port Authority and the majority maintain, involve governmental functions or arise out of a pure "exercise of discretion... with respect to [overall] security measures and the deployment of limited police resources" (majority op at 455). I therefore cannot join the majority holding that the Port Authority was absolutely immune from liability.

III.

Because the majority dismisses the claims based on its analysis of the governmental immunity issue, it has not addressed the Port Authority's other contentions. However, since I believe this case was properly submitted to the jury, I must consider the Port Authority's alternative arguments, including the contention that, even if not entitled to governmental immunity, reversal is nonetheless warranted either because the jury made its finding of negligence by applying an improper standard or the Port Authority satisfied its obligations as a proprietary landlord as a matter of law.

It is well settled that a proprietary landlord has an "obligation... to take reasonable steps to minimize the foreseeable danger [posed by criminal activity] to those unwary souls who might venture onto the premises" (Nallan v Helmsley-Spear, Inc., 50 N.Y.2d 507, 518 [1980]). This is a "natural corollary" to the landlord's "common-law duty to make the public areas of his property reasonably safe for those who might enter" (id. at 519). For a danger to be foreseeable, a landowner must "know[ ] or [have] reason to know from past experience `that there is a likelihood of conduct on the part of third persons which is likely to endanger the safety of the visitor'" (id. [ellipsis omitted], quoting Restatement [Second] of Torts § 344). If a danger is foreseeable, a landlord has a duty to employ reasonable measures to protect visitors from such risks, including danger posed by third parties. Of course, "foreseeability is generally an issue for the fact finder" (Bell v Board of Educ. of City of N.Y., 90 N.Y.2d 944, 946 [1997]). Concomitantly, "[w]hat safety precautions may reasonably be required of a landowner is almost always a question of fact for the jury" (Nallan, 50 NY2d at 520 n 8). In determining what is reasonable, the jury may consider "such variables as the seriousness of the risk and the cost of the various available safety measures" (id.).

Here, there was an adequate basis for the jury to conclude that an act of terrorism involving a truck or car bombing in the subterranean parking garage was foreseeable. There was ample evidence at trial demonstrating that the Port Authority was repeatedly warned by its consultants regarding its exposure to the risks associated with the detonation of a vehicle bomb in the parking facility. Experts warned that the "parking lots [were] ... highly susceptible to car bombings"; that there was "ample justification to take decisive target hardening measures" to prevent such a bombing; that such an attack was "probable"; and that the WTC, the premier symbol of American enterprise, was "highly vulnerable through the parking lot." Thus, it was the jury's prerogative to weigh the evidence and determine whether the Port Authority had adequate notice that such an incident was foreseeable and its conclusion was rational based on the evidence presented.

Furthermore, the jury found the Port Authority negligent under our well established tort standards. Supreme Court charged the jury that "negligence requires both a reasonable, foreseeable danger to another and conduct that is unreasonable in proportion to that danger." The court added that "the owner of a building such as the Port Authority has a duty to use reasonable care to keep the premises in a reasonably safe condition for the protection of all persons whose presence is reasonably foreseeable." Although the court did not use the "minimal precautions" language referenced in some of our cases, this did not impair the propriety of the instruction as the court effectively communicated the landowner's duty to reasonably and proportionally respond to foreseeable danger.

And I also believe that the verdict survives the Port Authority's sufficiency challenge. Undoubtedly, there was a record basis for the jury's determination that the Port Authority's response to a potential terrorist threat was less than reasonable, particularly in light of "the seriousness of the risk and the cost of the various available safety measures" (Nallan, 50 NY2d at 520 n 8). Needless to say, the scope of the risk of harm here was enormous. As the OSP Study Brief warned, a bomb in the garage could "cause extensive structural damage ... as well as a large number of casualties." The jury could have rationally determined that most of the security measures that the Port Authority declined to take, such as improving electronic surveillance, erecting barriers or having a manned ticket booth, would have cost little to implement compared to the consequences of the potential danger.

Finally, although there is a challenge to the manner in which the jury apportioned fault between the Port Authority and the terrorists, it does not afford this Court a basis for reversal. While there have been occasions when the Appellate Divisions have altered a jury's apportionment of fault as against the weight of the evidence (see Stevens v New York City Tr. Auth., 19 A.D.3d 583, 585 [2d Dept 2005]; Roseboro v New York City Tr. Auth., 10 A.D.3d 524, 526 [1st Dept 2004]), this Court is limited to considering questions of law, and thus lacks the authority to conduct a weight of the evidence review. Therefore, we cannot alter a jury's fault assessment on that basis.

From a moral standpoint, there is certainly no comparison between the reprehensible conduct of the terrorists and the negligent omissions attributed to the Port Authority. But the jury's task was not to assign moral blame. While, on this record, reasonable minds could certainly differ concerning the resolution of many of the factual issues presented to the jury, including the apportionment of fault, the jury's fault assessment was not so clearly unsupported by any rational inferences as to be subject to reversal as a matter of law.

In sum, I would affirm in this case because the Port Authority's failure to implement discrete and basic security measures in the public parking area of the commercial building complex arose from the exercise of its proprietary—rather than governmental—obligations. Treating the Port Authority as a private landlord, there was sufficient evidence at trial to support the jury's finding of liability and its apportionment of fault. Accordingly, such determination lies beyond our further review.

Judgment appealed from and order of the Appellate Division brought up for review reversed, etc.