We consider whether the government may employ random, suspicionless container searches in order to safeguard mass transportation facilities from terrorist attack. The precise issue before us is whether one such search regime, implemented on the New York City subway system, satisfies the special needs exception to the Fourth Amendment's usual requirement of individualized suspicion. We hold that it does.

Shortly after New York City implemented its search program, plaintiffs-appellants Brendan MacWade, Andrew Schonebaum, Joseph E. Gehring, Jr., Partha Banerjee, and Norman Murphy each attempted to enter the subway system. Each plaintiff either submitted to a baggage search and entered the subway or refused the search and consequently was required to exit the subway system. Disturbed by their treatment, they sued defendants-appellees New York City and Police Commissioner Raymond Kelly pursuant to 42 U.S.C. § 1983, asserting that the search regime violated the Fourth and Fourteenth Amendments. They sought a declaratory judgment, preliminary and permanent injunctive relief, and attorney's fees. After a two-day bench trial, the United States District Court for the Southern District of New York (Richard M. Berman, Judge) found the search program constitutional pursuant to the special needs exception and dismissed the complaint with prejudice. MacWade v. Kelly, 2005 WL 3338573 (S.D.N.Y. Dec. 7, 2005).

Plaintiffs timely appealed, raising three claims: (1) the special needs doctrine applies only in scenarios where the subject of a search possesses a diminished expectation of privacy, and because subway riders enjoy a full expectation of privacy in their bags, the District Court erred in applying the special needs exception here; (2) the District Court erred in finding that the search program serves a "special need" in the first instance; and (3) even if the search program serves a special need, the District Court erred in balancing the relevant factors because (a) the searches are intrusive; (b) there is no immediate terrorist threat; and (c) the City's evidence fails as a matter of law to establish that the Program is effective.

As set forth more fully below, we hold that the special needs doctrine may apply where, as here, the subject of a search possesses a full privacy expectation. Further, we hold that preventing a terrorist attack on the subway is a "special" need within the meaning of the doctrine. Finally, we hold that the search program is reasonable because it serves a paramount government interest and, under the circumstances, is narrowly tailored and sufficiently effective.

I. The Subway System and the Container Inspection Program

The New York City subway system is a singular component of America's urban infrastructure. The subway is an icon of the City's culture and history, an engine of its colossal economy, a subterranean repository of its art and music, and, most often, the place where millions of diverse New Yorkers and visitors stand elbow to elbow as they traverse the metropolis. Quantified, the subway system is staggering. It comprises 26 interconnected train lines and 468 far-flung passenger stations. It operates every hour of every day. On an average weekday, it carries more than 4.7 million passengers and, over the course of a year, it transports approximately 1.4 billion riders. By any measure, the New York City subway system is America's largest and busiest.

Given the subway's enclosed spaces, extraordinary passenger volume, and cultural and economic importance, it is unsurprising—and undisputed—that terrorists view it as a prime target. In fact, terrorists have targeted it before. In 1997, police uncovered a plot to bomb Brooklyn's Atlantic Avenue subway station—a massive commuter hub that joins 10 different subway lines and the Long Island Railroad. In 2004, police thwarted another plot to bomb the Herald Square subway station, which networks eight different subway lines in midtown Manhattan.

Other cities have not been so fortunate in protecting their mass transportation systems. In 2004, terrorists killed over 240 people by using concealed explosives to bomb commuter trains in Madrid and Moscow. On July 7, 2005, terrorists— again using concealed explosives—killed more than 56 people and wounded another 700 individuals by launching a coordinated series of attacks on the London subway and bus systems. Two weeks later, on July 21, 2005, terrorists launched a second but unsuccessful wave of concealed explosive attacks on the London subway system.

That same day, the New York City Police Department ("NYPD") announced the Container Inspection Program (the "Program") that is the subject of this litigation. The NYPD designed the Program chiefly to deter terrorists from carrying concealed explosives onto the subway system and, to a lesser extent, to uncover any such attempt. Pursuant to the Program, the NYPD establishes daily inspection checkpoints at selected subway facilities. A "checkpoint" consists of a group of uniformed police officers standing at a folding table near the row of turnstiles disgorging onto the train platform. At the table, officers search the bags of a portion of subway riders entering the station.

In order to enhance the Program's deterrent effect, the NYPD selects the checkpoint locations "in a deliberative manner that may appear random, undefined, and unpredictable." In addition to switching checkpoint locations, the NYPD also varies their number, staffing, and scheduling so that the "deployment patterns ... are constantly shifting." While striving to maintain the veneer of random deployment, the NYPD bases its decisions on a sophisticated host of criteria, such as fluctuations in passenger volume and threat level, overlapping coverage provided by its other counter-terrorism initiatives, and available manpower.

The officers assigned to each checkpoint give notice of the searches and make clear that they are voluntary. Close to their table they display a large poster notifying passengers that "backpacks and other containers [are] subject to inspection." The Metropolitan Transportation Authority, which operates the subway system, makes similar audio announcements in subway stations and on trains. A supervising sergeant at the checkpoint announces through a bullhorn that all persons wishing to enter the station are subject to a container search and those wishing to avoid the search must leave the station. Although declining the search is not by itself a basis for arrest, the police may arrest anyone who refuses to be searched and later attempts to reenter the subway system with the uninspected container.

Officers exercise virtually no discretion in determining whom to search. The supervising sergeant establishes a selection rate, such as every fifth or tenth person, based upon considerations such as the number of officers and the passenger volume at that particular checkpoint. The officers then search individuals in accordance with the established rate only.

Once the officers select a person to search, they limit their search as to scope, method, and duration. As to scope, officers search only those containers large enough to carry an explosive device, which means, for example, that they may not inspect wallets and small purses. Further, once they identify a container of eligible size, they must limit their inspection "to what is minimally necessary to ensure that the ... item does not contain an explosive device," which they have been trained to recognize in various forms. They may not intentionally look for other contraband, although if officers incidentally discover such contraband, they may arrest the individual carrying it.1 Officers may not attempt to read any written or printed material. Nor may they request or record a passenger's personal information, such as his name, address, or demographic data.

The preferred inspection method is to ask the passenger to open his bag and manipulate his possessions himself so that the officer may determine, on a purely visual basis, if the bag contains an explosive device. If necessary, the officer may open the container and manipulate its contents himself. Finally, because officers must conduct the inspection for no "longer than necessary to ensure that the individual is not carrying an explosive device," a typical inspection lasts for a matter of seconds.

II. The Bench Trial and the District Court's Decision

Two weeks after the Program commenced, plaintiffs sued to halt it. During discovery, plaintiffs requested that the NYPD produce confidential data reflecting the number and location of checkpoints deployed since the Program's inception. The District Court conditioned discovery of that information on a showing of need. Instead of attempting to establish that need at an evidentiary hearing, plaintiffs elected to proceed to trial but reserved their right to reopen the record.

The bench trial lasted two days. Of the evidence elicited, most relevant to this appeal is the testimony of three defense expert witnesses: David Cohen, the NYPD's Deputy Commissioner for Intelligence, Michael Sheehan, the NYPD's Deputy Commissioner for Counter-Terrorism, and Richard C. Clarke, former Chair of the Counter-Terrorism Security Group of the National Security Council. Because each witness offered nearly identical opinions as to the Program's efficacy, and supported their opinions with nearly identical reasons, we summarize their testimony in one piece. Before doing that, we pause briefly to note the basis of each witness's expertise, as their credentials are essential to understanding why the District Court credited their testimony.

Cohen served for 35 years in the analysis and operations divisions of the Central Intelligence Agency. Early in his career, he established the CIA's first terrorism analysis program. When he later became the Deputy Director of the CIA's Directorate of Operations, he oversaw the CIA's entire analysis program on a daily basis, including its preparation of political, military, and economic assessments for the President and his senior national security advisors. Later, as the Director of the Directorate of Operations, he bore responsibility for the agency's worldwide counter-terrorism operations. At that time, he created the CIA's Al Qaeda Osama bin Laden unit. In 2002 he joined the NYPD and assumed responsibility for its intelligence programs.

Like Cohen, Sheehan has considerable counter-terrorism experience. He began his career as a member of a counter-terrorism unit in the U.S. Army's Special Forces. He served under two Presidents as the National Security Council's Director of International Programs, and later served as the State Department's Ambassador-at-Large for Counter-Terrorism. In 2003 he joined the NYPD, where he commands its counter-terrorism division and its contingent of the F.B.I. joint terrorism task force. In his current post, he bears responsibility for "critical infrastructure protection."

Clarke also possesses substantial counter-terrorism experience. For seven years he served in the Department of State, holding the positions of Assistant Secretary for Politico-Military Affairs and Deputy Assistant Secretary for Intelligence. For the following 11 years he held a number of positions on the National Security Council, including Chair of its Counter-Terrorism Security Group, National Coordinator for Security, Infrastructure Protection, and Counter-Terrorism, and Special Advisor to four Presidents.

The expert testimony established that terrorists "place a premium" on success. Accordingly, they seek out targets that are predictable and vulnerable—traits they ascertain through surveillance and a careful assessment of existing security measures. They also plan their operations carefully: they "rehearse [the attack], they train it, they do dry runs." In light of these priorities, the Al Qaeda Manual advises that terrorists "traveling on a mission" should avoid security "check points along the way."

The witnesses also testified that the Program's flexible and shifting deployment of checkpoints deters a terrorist attack because it introduces the variable of an unplanned checkpoint inspection and thus "throws uncertainty into every aspect of terrorist operations—from planning to implementation." Terrorists "don't want to be in a situation where one of their bombs doesn't go off, because on the day that they chose to go in subway station X, there were police doing searches." That unpredictability deters both a single-bomb attack and an attack consisting of multiple, synchronized bombings, such as those in London and Madrid.

Because the Program deters a terrorist from planning to attack the subway in the first place, the witnesses testified, the fact that a terrorist could decline a search and leave the subway system makes little difference in assessing the Program's efficacy. Similarly, the precise number of checkpoints employed on any given day is relatively unimportant because the critical aspects of the Program are that it is "random" and "routine," the combination of which "creates an incentive for terrorists to choose ... an easier target." Finally, the testimony established that each of the City's counter-terrorism programs incrementally increases security and that taken together, the programs "address the broad range of concerns related to terrorist activity" and "have created an environment in New York City that has made it more difficult for terrorists to operate."

After the close of testimony, plaintiffs renewed their request for discovery of data reflecting the number of subway station checkpoints established throughout the City since the Program's inception. The District Court ordered defendants to produce the data for in camera inspection. See MacWade, 2005 WL 3338573, at *14. After that inspection, the District Court entered the data in the record under seal, allowed plaintiffs' lead counsel to view it, and ordered sealed any documents revealing or tending to reveal it, such as post-trial submissions.

After taking those submissions under consideration and hearing closing arguments, the District Court issued an opinion in which it concluded that the Program was constitutional pursuant to the special needs exception. In its analysis, the District Court determined that the Program served a special need because it aimed to prevent, through deterrence and detection, "a terrorist attack on the subways." Id. at *17.

Having established that the Program served a special need, the District Court proceeded to balance several factors. It concluded that the government interest in preventing a terrorist attack on the subway was "of the very highest order." Id. at *17. As to the Program's efficacy, the District Court credited the expert testimony of Sheehan, Cohen, and Clarke in concluding that the Program was a "reasonable method of deterring (and detecting) a terrorist bombing" on the subway. Id. at *18. Although the District Court concluded that scrutinizing the sealed NYPD checkpoint data was neither "necessary or probative," id. at *15, it reviewed the data and concluded, in relevant part, that: (1) the Program was ongoing; and (2) with one exception, the NYPD established checkpoints on a daily basis between July 22, 2005 and November 6, 2005. Id. at *13-14.

Finally, the District Court resolved that the searches were "narrowly tailored and only minimally intrude[] upon privacy interests." Id. at *19-20. Accordingly, the Court concluded that on balance the Program was constitutional, denied plaintiffs' application for declaratory and injunctive relief, and dismissed the complaint with prejudice. Id. at *20. This appeal promptly ensued.

Because this appeal follows a bench trial, we review the District Court's findings of fact for clear error, but we review de novo its conclusions of law and its resolution of mixed questions of fact and law. See, e.g., Rose v. AmSouth Bank of Florida, 391 F.3d 63, 65 (2d Cir.2004).

The Fourth Amendment to the Constitution provides that, "The right of the people to be secure in their persons, houses, papers, and effects, against unreasonable searches and seizures, shall not be violated, and no Warrants shall issue, but upon probable cause...." As the Fourth Amendment's text makes clear, the concept of reasonableness is the "touchstone of the constitutionality of a governmental search." Bd. of Educ. v. Earls, 536 U.S. 822, 828, 122 S. Ct. 2559, 153 L. Ed. 2d 735 (2002). "What is reasonable, of course, depends on all of the circumstances surrounding the search or seizure and the nature of the search or seizure itself." Skinner v. Railway Labor Exec. Ass'n, 489 U.S. 602, 619, 109 S. Ct. 1402, 103 L. Ed. 2d 639 (1989) (internal quotation marks omitted). As a "general matter," a search is unreasonable unless supported "by a warrant issued upon probable cause...." Nat'l Treasury Employees Union v. Von Raab, 489 U.S. 656, 665, 109 S. Ct. 1384, 103 L. Ed. 2d 685 (1989). However, "neither a warrant nor probable cause, nor, indeed, any measure of individualized suspicion, is an indispensable component of reasonableness in every circumstance." Id.

In light of those "longstanding" principles, id., we upheld a program employing metal detectors and hand searches of carry-on baggage at airports. See United States v. Edwards, 498 F.2d 496, 500-01 (2d Cir.1974). We determined that the "purpose" of the search program was not to serve "as a general means for enforcing the criminal laws" but rather to "prevent airplane hijacking" by "terrorists[.]" Id. at 500. We then dispensed with the traditional warrant and probable cause requirements and instead balanced "the need for a search against the offensiveness of the intrusion." Id. We concluded that,

When the risk is the jeopardy to hundreds of human lives and millions of dollars of property inherent in the pirating or blowing up of a large airplane, the danger alone meets the test of reasonableness, so long as the search is conducted in good faith for the purpose of preventing hijacking or like damage and with reasonable scope and the passenger has been given advance notice of his liability to such a search so that he can avoid it by choosing not to travel by air.

Id. Although at the time we lodged our decision within the broad rubric of reasonableness, id. at 498 n. 5, our reasoning came to be known as the "special needs exception" roughly one decade later. See New Jersey v. T.L.O., 469 U.S. 325, 351, 105 S. Ct. 733, 83 L. Ed. 2d 720 (1985) (Blackmun, J., concurring) ("Only in those exceptional circumstances in which special needs, beyond the need for normal law enforcement, make the warrant and probable-cause requirement impracticable, is a court entitled to substitute its balancing of interests for that of the Framers."). Both before and after the doctrine's formal denomination, courts have applied it in a variety of contexts relevant here, including random airport searches, see United States v. Marquez, 410 F.3d 612 (9th Cir.2005), and highway sobriety checkpoints, see Michigan Dep't of State Police v. Sitz, 496 U.S. 444, 110 S. Ct. 2481, 110 L. Ed. 2d 412 (1990). See also Illinois v. Lidster, 540 U.S. 419, 424, 124 S. Ct. 885, 157 L. Ed. 2d 843 (2004) (highway information-gathering checkpoints); United States v. Martinez-Fuerte, 428 U.S. 543, 557, 96 S. Ct. 3074, 49 L. Ed. 2d 1116 (1976) (border patrol checkpoints); United States v. Green, 293 F.3d 855 (5th Cir.2002) (random checkpoint stops near military installation).

The doctrine's central aspects are as follows. First, as a threshold matter, the search must "serve as [its] immediate purpose an objective distinct from the ordinary evidence gathering associated with crime investigation." Nicholas v. Goord, 430 F.3d 652, 663 (2d Cir.2005).2 Second, once the government satisfies that threshold requirement, the court determines whether the search is reasonable by balancing several competing considerations. See, e.g., id. at 669-70. These balancing factors include (1) the weight and immediacy of the government interest, Earls, 536 U.S. at 834, 122 S. Ct. 2559; (2) "the nature of the privacy interest allegedly compromised by" the search, id. at 830, 122 S. Ct. 2559; (3) "the character of the intrusion imposed" by the search, id. at 832, 122 S. Ct. 2559; and (4) the efficacy of the search in advancing the government interest, id. at 834, 122 S. Ct. 2559.

We address in turn each of plaintiffs' arguments as delineated in the introduction.

A. The special needs doctrine does not require that the subject of the search possess a diminished privacy interest

Plaintiffs first raise the purely legal contention that, as a threshold matter, the special needs doctrine applies only where the subject of the search possesses a reduced privacy interest. While it is true that in most special needs cases the relevant privacy interest is somewhat "limited," see Earls, 536 U.S. at 832, 122 S. Ct. 2559 (considering the privacy interest of public schoolchildren), the Supreme Court never has implied—much less actually held—that a reduced privacy expectation is a sine qua non of special needs analysis. For example, in Ferguson v. Charleston, 532 U.S. 67, 86, 121 S. Ct. 1281, 149 L. Ed. 2d 205 (2001) the Court struck down a warrantless, suspicionless search regime in which a hospital subjected prenatal care patients to drug tests and then disclosed the test results to the police for law enforcement purposes. The Court expressly noted that the patients had a full privacy expectation in their medical test results but that the existence of such a privacy expectation was not "critical[.]" Ferguson, 532 U.S. at 78, 121 S. Ct. 1281. Instead, the "critical difference" upon which the decision turned was that the policy failed to serve a special need "divorced from the State's generalized interest in law enforcement." Id. at 79, 121 S. Ct. 1281.

That approach comports with our long-standing view that the nature of the relevant privacy interest must not be treated in isolation or accorded dispositive weight, but rather must be balanced against other fact-specific considerations. In United States v. Albarado, we dismissed the notion that a full expectation of privacy, by itself, rendered unconstitutional warrantless, suspicionless magnetometer searches:

It has been suggested that those who seek to travel on a common carrier have a lower "expectation of privacy" regarding their person and the bags they carry.... Such a suggestion has little analytical significance; if it were announced that all telephone lines would be tapped, it could be claimed that the public had no expectation of privacy on the telephone. What is clear is that the public does have the expectation, or at least under our Constitution has the right to expect, that no matter the threat, the search to counter it will be as limited as possible, consistent with meeting the threat.

495 F.2d 799, 806 (2d Cir.1974).

Neither United States v. Lifshitz, 369 F.3d 173 (2d Cir.2004), nor Nicholas, upon which plaintiffs rely, contradicts that principle. Although in those cases we noted that the nature of the privacy expectation is an important factor in the special needs analysis, we did not impose a threshold requirement that the relevant privacy interest be diminished. Indeed, since each of those cases concerned individuals with reduced privacy interests, we had no occasion to consider whether the special needs exception might sometimes apply even to those with a full expectation of privacy. Nicholas, 430 F.3d at 669 (prison inmates); Lifshitz, 369 F.3d at 190 (probationer).

Further, in Nicholas we expressly rejected the contention that application of the special needs doctrine turns on the type of privacy interest at stake.3 Nicholas, 430 F.3d at 666 ("The problem with this argument is that neither Ferguson nor Edmond rested upon plaintiffs' undiminished expectation of privacy."). Instead, we identified the existence of a special need and then treated the privacy interest as a factor to be weighed in the balance. Id. at 669; Lifshitz, 369 F.3d at 189-93; see also Earls, 536 U.S. at 831 n. 3, 122 S. Ct. 2559 (noting that a student's limited privacy interest was "a hefty weight on the side of the school's balance"); Skinner, 489 U.S. at 619, 109 S. Ct. 1402 ("When faced with such special needs, we have not hesitated to balance the governmental and privacy interests....").

Accordingly, to the extent that the principle needs clarification, we expressly hold that the special needs doctrine does not require, as a threshold matter, that the subject of the search possess a reduced privacy interest. Instead, once the government establishes a special need, the nature of the privacy interest is a factor to be weighed in the balance.

B. The container inspection program serves a special need

Plaintiffs next maintain that the District Court erred in concluding that the Program serves the special need of preventing a terrorist attack on the subway. Plaintiffs contend that the Program's immediate objective is merely to gather evidence for the purpose of enforcing the criminal law.

As a factual matter, we agree with the District Court's conclusion that the Program aims to prevent a terrorist attack on the subway. Defendants implemented the Program in response to a string of bombings on commuter trains and subway systems abroad, which indicates that its purpose is to prevent similar occurrences in New York City. In its particulars, the Program seeks out explosives only: officers are trained to recognize different explosives, they search only those containers capable of carrying explosive devices, and they may not intentionally search for other contraband, read written or printed material, or request personal information. Additionally, the Program's voluntary nature illuminates its purpose: that an individual may refuse the search provided he leaves the subway establishes that the Program seeks to prevent a terrorist, laden with concealed explosives, from boarding a subway train in the first place.

As a legal matter, courts traditionally have considered special the government's need to "prevent" and "discover . . . latent or hidden" hazards, Von Raab, 489 U.S. at 668, 109 S. Ct. 1384, in order to ensure the safety of mass transportation mediums, such as trains, airplanes, and highways. See Sitz, 496 U.S. 444, 110 S. Ct. 2481, 110 L. Ed. 2d 412 (highway sobriety checkpoint); Skinner, 489 U.S. 602, 109 S. Ct. 1402, 103 L. Ed. 2d 639 (drug testing of railroad employees); Edwards, 498 F.2d 496 (airplane baggage search). We have no doubt that concealed explosives are a hidden hazard, that the Program's purpose is prophylactic, and that the nation's busiest subway system implicates the public's safety. Accordingly, preventing a terrorist from bombing the subways constitutes a special need that is distinct from ordinary post hoc criminal investigation. See United States v. Hartwell, 436 F.3d 174, 179 (3d Cir.2006) (Alito, J.) (rejecting Fourth Amendment challenge to airport checkpoints and recognizing the need to "prevent[] terrorist attacks on airplanes"); United States v. Marquez, 410 F.3d 612, 617 (9th Cir.2005) (noting that airport searches are conducted for the parallel purposes of "prevent[ing] passengers from carrying weapons or explosives onto the aircraft" and "deter[ring] passengers from even attempting to do so"); Edwards, 498 F.2d at 500-01; Albarado, 495 F.2d at 804 ("One of the prime purposes of the search, moreover, is deterrence, the knowledge that such searches are conducted acting to deter potential hijackers from even attempting to bring weapons on a plane."); see also City of Indianapolis v. Edmond, 531 U.S. 32, 47-48, 121 S. Ct. 447, 148 L. Ed. 2d 333 (2000) (noting the "validity of ... searches at places like airports and government buildings, where the need for such measures to ensure public safety can be particularly acute"). Further, the fact that an officer incidentally may discover a different kind of contraband and arrest its possessor does not alter the Program's intended purpose. Edwards, 498 F.2d at 500.

Relying on dicta in Edmond, in which the Supreme Court struck down a drug interdiction checkpoint, plaintiffs urge the extraordinarily broad legal principle that a terrorist checkpoint serves a special need only in the face of an imminent attack. The Edmond Court merely remarked that under such dire circumstances, "[f]or example," a checkpoint regime "would almost certainly" be constitutional. Edmond, 531 U.S. at 44, 121 S. Ct. 447. That passing observation is neither controversial nor constraining. Indeed, the Edmond Court pointed out that although it struck down the drug interdiction checkpoint for lack of a special need, its holding did "nothing to alter the constitutional status of the sobriety and border checkpoints that we approved" previously, and that the "constitutionality of such checkpoint programs still depends on a balancing of the competing interests at stake and the effectiveness of the program." Id. at 47, 121 S. Ct. 447; Nat'l Treasury Employees Union v. Von Raab, 489 U.S. 656, 675 n. 3, 109 S. Ct. 1384, 103 L. Ed. 2d 685 (1989) ("Yet we would not suppose that, if the validity of these searches be conceded, the Government would be precluded from conducting them absent a demonstration of danger as to any particular airport or airline."). Where, as here, a search program is designed and implemented to seek out concealed explosives in order to safeguard a means of mass transportation from terrorist attack, it serves a special need.

C. On balance, the Program is constitutional

Having concluded that the Program serves a special need, we next balance the factors set forth above to determine whether the search is reasonable and thus constitutional.

(i) The government interest is immediate and substantial

Given the "enormous dangers to life and property from terrorists" bombing the subway, "we need not labor the point with respect to need...." United States v. Edwards, 498 F.2d 496, 500 (2d Cir.1974). As they must, plaintiffs concede that the interest in preventing such an attack is "paramount" but contend that the lack of "any specific threat to the subway system" weakens that interest by depriving it of immediacy. Plaintiffs again overstate the relevance of a specific, extant threat.

The Supreme Court, citing Edwards as "a leading case," noted that no express threat or special imminence is required before we may accord great weight to the government's interest in staving off considerable harm. See Von Raab, 489 U.S. at 675 n. 3, 109 S. Ct. 1384 (noting that "a demonstration of danger as to any particular airport or airline" is not required since "[i]t is sufficient that the Government have a compelling interest in preventing an otherwise pervasive societal problem from spreading"). All that is required is that the "risk to public safety [be] substantial and real" instead of merely "symbolic." Chandler v. Miller, 520 U.S. 305, 322-23, 117 S. Ct. 1295, 137 L. Ed. 2d 513 (1997) ("[W]here the risk to public safety is substantial and real, blanket suspicionless searches calibrated to the risk may rank as `reasonable'—for example, searches now routine at airports and at entrances to courts and other official buildings."); see also Bd. of Educ. v. Earls, 536 U.S. 822, 835-36, 122 S. Ct. 2559, 153 L. Ed. 2d 735 (2002) (noting that "the need to prevent and deter the substantial harm of childhood drug use provides the necessary immediacy" and that the school district need not await a "particularized or pervasive drug problem before . . . conduct[ing] suspicionless drug testing").

Pursuant to this standard, the threat in this case is sufficiently immediate. In light of the thwarted plots to bomb New York City's subway system, its continued desirability as a target, and the recent bombings of public transportation systems in Madrid, Moscow, and London, the risk to public safety is substantial and real. Cf. Hartwell, 436 F.3d at 179 ("[T]here can be no doubt that preventing terrorist attacks on airplanes is of paramount importance."); Marquez, 410 F.3d at 618 ("It is hard to overestimate the need to search air travelers for weapons and explosives before they are allowed to board the aircraft. As illustrated over the last three decades, the potential damage and destruction from air terrorism is horrifically enormous."). The District Court did not err in according this factor substantial weight in support of constitutionality.

(ii) A subway rider has a full expectation of privacy in his containers

Although not a dispositive, threshold consideration, the nature of the privacy interest compromised by the search remains an important balancing factor. Whether an expectation of privacy exists for Fourth Amendment purposes depends upon two questions. "First, we ask whether the individual, by his conduct, has exhibited an actual expectation of privacy . . . ." Bond v. United States, 529 U.S. 334, 338, 120 S. Ct. 1462, 146 L. Ed. 2d 365 (2000). "Second, we inquire whether the individual's expectation of privacy is one that society is prepared to recognize as reasonable." Id. (internal quotation marks omitted).

As to the first question, a person carrying items in a closed, opaque bag has manifested his subjective expectation of privacy by keeping his belongings from plain view and indicating "that, for whatever reason, [he] prefer[s] to keep [them] close at hand." Id. Further, the Supreme Court has recognized as objectively reasonable a bus rider's expectation that his bag will not be felt "in an exploratory manner" from the outside, id. at 338-39, 120 S. Ct. 1462, let alone opened and its contents visually inspected or physically manipulated. See generally New Jersey v. T.L.O., 469 U.S. 325, 338, 105 S. Ct. 733, 83 L. Ed. 2d 720 (1985) ("[T]he Fourth Amendment provides protection to the owner of every container that conceals its contents from plain view." (internal quotation marks omitted)). Accordingly, a subway rider who keeps his bags on his person possesses an undiminished expectation of privacy therein. We therefore weigh this factor in favor of plaintiffs.

(iii) The search is minimally intrusive

Although a subway rider enjoys a full privacy expectation in the contents of his baggage, the kind of search at issue here minimally intrudes upon that interest. Several uncontested facts establish that the Program is narrowly tailored to achieve its purpose: (1) passengers receive notice of the searches and may decline to be searched so long as they leave the subway, see Hartwell, 436 F.3d at 180-81; Marquez, 410 F.3d at 617-18; Edwards, 498 F.2d at 500; (2) police search only those containers capable of concealing explosives, inspect eligible containers only to determine whether they contain explosives, inspect the containers visually unless it is necessary to manipulate their contents, and do not read printed or written material or request personal information, see Marquez, 410 F.3d at 617; (3) a typical search lasts only for a matter of seconds, see Illinois v. Lidster, 540 U.S. 419, 427, 124 S. Ct. 885, 157 L. Ed. 2d 843 (2004); (4) uniformed personnel conduct the searches out in the open, which reduces the fear and stigma that removal to a hidden area can cause, see United States v. Martinez-Fuerte, 428 U.S. 543, 558, 96 S. Ct. 3074, 49 L. Ed. 2d 1116 (1976); Hartwell, 436 F.3d at 180; and (5) police exercise no discretion in selecting whom to search, but rather employ a formula that ensures they do not arbitrarily exercise their authority, see Von Raab, 489 U.S. at 667; 109 S. Ct. 1384; United States v. Green, 293 F.3d 855, 860 (5th Cir.2002). Although defendants need not employ "the least intrusive means," Earls, 536 U.S. at 837, 122 S. Ct. 2559, to serve the state interest, it appears they have approximated that model. Given the narrow tailoring that the Program achieves, this factor weighs strongly in favor of defendants, as the District Court properly concluded.

(iv) The Program is reasonably effective

In considering the "degree to which the seizure advances the public interest," we must remember not to wrest "from politically accountable officials ... the decision as to which among reasonable alternative law enforcement techniques should be employed to deal with a serious public danger." Michigan Dep't of State Police v. Sitz, 496 U.S. 444, 453-54, 110 S. Ct. 2481, 110 L. Ed. 2d 412 (1990) (internal quotation marks omitted). That decision is best left to those with "a unique understanding of, and responsibility for, limited public resources, including a finite number of police officers." Id. 22 at 454, 110 S. Ct. 2481. Accordingly, we ought not conduct a "searching examination of effectiveness." Id. at 454, 110 S. Ct. 2481 (internal quotation marks omitted); see also Hartwell, 436 F.3d at 179-80 n. 9 (recognizing the court's limited role in gauging efficacy). Instead, we need only determine whether the Program is "a reasonably effective means of addressing" the government interest in deterring and detecting a terrorist attack on the subway system. Earls, 536 U.S. at 837, 122 S. Ct. 2559; Maxwell v. City of New York, 102 F.3d 664, 667 (2d Cir.1996).

The District Court credited the expert testimony of Sheehan, Cohen, and Clarke concerning the Program's deterrent effect. Plaintiffs neither contest their expertise nor directly attack the substance of their testimony. Instead, plaintiffs claim that the Program can have no meaningful deterrent effect because the NYPD employs too few checkpoints. In support of that claim, plaintiffs rely upon various statistical manipulations of the sealed checkpoint data.

We will not peruse, parse, or extrapolate four months' worth of data in an attempt to divine how many checkpoints the City ought to deploy in the exercise of its day-to-day police power. Counter-terrorism experts and politically accountable officials have undertaken the delicate and esoteric task of deciding how best to marshal their available resources in light of the conditions prevailing on any given day. We will not—and may not—second-guess the minutiae of their considered decisions.4 Sitz, 496 U.S. at 453, 110 S. Ct. 2481.

Instead, we must consider the Program at the level of its design. See, e.g., Skinner v. Railway Labor Exec. Ass'n, 489 U.S. 602, 629, 109 S. Ct. 1402, 103 L. Ed. 2d 639 (1989) ("While no procedure can identify all impaired employees ... the FRA regulations supply an effective means of deterring employees engaged in safety-sensitive tasks from using controlled substances or alcohol in the first place."); Lidster, 540 U.S. at 427, 124 S. Ct. 885; Earls, 536 U.S. at 837-38, 122 S. Ct. 2559; Von Raab, 489 U.S. at 675 n. 3 & 676, 109 S. Ct. 1384. From that vantage, the expert testimony established that terrorists seek predictable and vulnerable targets, and the Program generates uncertainty that frustrates that goal, which, in turn, deters an attack. See Marquez, 410 F.3d at 617("[T]he randomness [of the searches] arguably increases the deterrent effects of airport screening procedures . . . ."); Green, 293 F.3d at 862 (noting deterrent effect of stopping every sixth car traveling near a military installation).

Plaintiffs next contend that because defendants' experts could not quantify the Program's deterrent effect, their testimony fails as a matter of law to establish efficacy. The concept of deterrence need not be reduced to a quotient before a court may recognize a search program as effective.5 Indeed, expressing the phenomena in numeric terms often is impossible because deterrence by definition results in an absence of data. See Von Raab, 489 U.S. at 675 n. 3, 109 S. Ct. 1384 ("Nor would we think, in view of the obvious deterrent purpose of these searches, that the validity of the Government's airport screening program necessarily turns on whether significant numbers of putative air pirates are actually discovered by the searches conducted under the program."). For that same reason, the absence of a formal study of the Program's deterrent effect does not concern us.

Plaintiffs further claim that the Program is ineffective because police notify passengers of the searches, and passengers are free to walk away and attempt to reenter the subway at another point or time. Yet we always have viewed notice and the opportunity to decline as beneficial aspects of a suspicionless search regime because those features minimize intrusiveness. Edwards, 498 F.2d at 500 (upholding suspicionless airport searches as reasonable "so long as ... the passenger has been given advance notice of his liability to such a search so that he can avoid it by choosing not to travel by air"). Striking a search program as ineffective on account of its narrow tailoring would create a most perverse result: those programs "more pervasive and more invasive of privacy" more likely would satisfy the Fourth Amendment. Von Raab, 489 U.S. at 676-77 n. 4, 109 S. Ct. 1384 (internal quotation marks omitted).

Importantly, if a would-be bomber declines a search, he must leave the subway or be arrested—an outcome that, for the purpose of preventing subway bombings, we consider reasonably effective, especially since the record establishes that terrorists prize predictability. See id. at 676, 109 S. Ct. 1384 (noting that such "avoidance techniques" can be "fraught with uncertainty" because a random search program "cannot be predicted" and its machinations are "not likely to be known or available"). An unexpected change of plans might well stymie the attack, disrupt the synchronicity of multiple bombings, or at least reduce casualties by forcing the terrorist to detonate in a less populated location.

Finally, plaintiffs claim that since no other city yet has employed a similar search program, New York's must be ineffective. In the first place, plaintiffs' inference is flawed: other cities must design programs according to their own resources and needs, which, quite apart from the question of efficacy, may not warrant or make possible such an initiative. Further, the upshot of plaintiffs' argument—that a program must be duplicated before it may be constitutional—strikes us as unsustainable. All things considered, the District Court properly concluded that the Program is reasonably effective.

In sum, we hold that the Program is reasonable, and therefore constitutional, because (1) preventing a terrorist attack on the subway is a special need; (2) that need is weighty; (3) the Program is a reasonably effective deterrent; and (4) even though the searches intrude on a full privacy interest, they do so to a minimal degree. We thus AFFIRM the judgment of the District Court.