Imagine the following hypothetical.
The owner of an ice rink, where a famous figure skater trains, hires a private security company. The owner’s main concern is that the rink has become overwhelmed with onlookers. These crowds swell beyond the building’s capacity, exposing him to large fines for violating the town’s building code. In addition, the crowds have made the rink difficult to monitor, which has allowed people to steal equipment.
As set forth in their contract, the owner hires the security company to alleviate these concerns. So pursuant to that goal, the company stations a guard at the front and rear entrances to check visitors in and keep count of the number of people in the building. The purpose of the check-in is to slow the influx of people, not bar unauthorized personnel. The company also stations guards at the entrance to both locker rooms, to reduce the risk of equipment theft.
One afternoon, the famous skater finishes training and begins walking to the locker room. Seconds later, a visitor bursts into the hallway, past the security guard near the locker room, and strikes the skater on the knee with a small club. The blow damages her knee to the point she cannot compete for over a year. In response, she sues the rink owner and security company for negligence, alleging they failed to protect her from the assailant.
Unfortunately for the skater, her claim against the security company is likely to fail. This may seem odd given the company had guards onsite and the assailant rushed past one of them on his way to her knee. If guards cannot provide security against an attack like this, how could they claim to have done their jobs?
The answer is that it depends on what their job is. Or as the law might phrase it, the answer depends on the company’s duty. In Illinois, to succeed on a negligence claim, the plaintiff must first show the defendant owed her a duty to prevent the injury. Here, the security company was not hired to protect the skater, or anyone else in the rink. Rather, it was hired to control the number of visitors and prevent theft. This included the guard stationed near the assault, who was there to keep equipment from being taken.
Essentially, at its core, duty is a recognition that a security company should only be required to protect who or what it is hired to protect. Indeed, if, for example, the rink owner had been concerned about violence against the skater and, therefore, hired the security company to bar unauthorized personnel from the building, the skater would have a stronger argument that the company owed her a duty.
This article will examine the duty element in the context of negligence claims against private security companies. More specifically, these are claims against security companies for failing to protect the plaintiff from a third-party attack. In these cases, duty is a moving target that depends on the reason for hiring the security guards. Typically, this is set forth in the contract between the security company and the hiring party. The central issue is whether that duty extends to the plaintiff and prevention of his or her injuries. Where it does, liability against the company could follow. But where it doesn’t, the plaintiff’s claim is likely to fail.
Duty and the Voluntary Undertaking
In Illinois, a negligence claim consists of three elements: (1) a duty owed by the defendant to the plaintiff; (2) the defendant’s breach of that duty; and (3) the plaintiff’s injury resulting from the breach. To satisfy the duty element, the scope of the security company’s duty must encompass protecting the plaintiff from the harm he or she suffered. The issue is not merely whether the company has a duty to someone or something. Rather, the company must have a duty to the plaintiff.
Under most circumstances, a party owes no duty to protect another from a third-party’s harmful or criminal acts. But this rule has four exceptions: (1) the parties are in a special relationship (ex. common carrier/passenger) and the harm is foreseeable; (2) an employee is in imminent danger and this is known to the employer; (3) a principal fails to warn its agent of unreasonable risk of harm involved in the agency; and (4) a party voluntarily assumes a duty to protect another from third party acts. Typically, the only exception relevant to security companies is the fourth: the voluntary undertaking.
When a security company voluntarily undertakes a duty, the scope depends on the extent of the undertaking. In turn, the extent of the undertaking depends on the reason for hiring the company. And this, in turn, depends on the contract between the company and the hiring party.
Duty to the Plaintiff
Illinois courts have not set forth objective rules for determining what kind of contractual language confers a duty to protect plaintiffs from third-party attacks. In most cases, the analysis is presented as a totality-of-the-circumstances test. That is, courts examine several of the company’s responsibilities under the contract and the extent to which it controls security operations. Nonetheless, from a practical standpoint, two aspects of the contractual language hold the most influence over a security company’s duty: (1) explicit assumptions and disclaimers of liability; and (2) the protection of people vs. the protection of property.
Explicit Assumptions and Disclaimers of Liability
Some private security contracts will make a clear statement of the contractor’s duty. This can be a disclaimer, rejecting a duty to prevent injury or death, or an explicit assumption, conferring such a duty. In many instances, the disclaimer or assumption is the most important factor in establishing a duty to the plaintiff (or lack thereof).
For example, in Aidroos, a disclaimer defeated the plaintiffs’ wrongful death claims , despite the security company’s guard offering no resistance to an armed attacker. There, Navistar Transportation hired Vance Uniformed Protection Services to provide security for its facility in Melrose Park. The parties’ contract specified that Vance’s “principal function” was to “maintain a presence, to observe and to report.” Further, the company was not “responsible for any theft, damage, destruction, loss of property, personal injury or death” and did not have liability “arising from the criminal acts of any third parties.”
On February 5, 2001, a disgruntled ex-Navistar employee forced his way into the facility, where he shot and killed four people. The former employee gained access by holding a gun to the head of the Vance guard at the front gate and demanding she escort him to the building where the shooting began. The four victims’ estates sued Vance for negligence and wrongful death, arguing Vance undertook a duty to protect employees at Navistar’s facility from “injury or death due to violent criminal attacks from third parties.”
But for the plaintiffs, the disclaimer was insurmountable. So even though Vance’s guard let the gunman into the facility, escorted him to his target and opened the building door, the Court still ruled the company had no duty to prevent the shooting. Essential to its analysis was the contractual language, which “specifically stated that Vance did not guarantee the personal safety of any person and had no liability arising from the criminal acts of any third parties.”
Compare this result to McKenna. In that case, the property manager, NACA, hired AlliedBarton to assist with security at Chicago’s Ogilvie Transportation Center and the office tower above it. The contract included a warning that violence from unauthorized visitors was a particular concern and required Allied to implement specific protocols designed to prevent it. In other words, the contract not only placed a duty on the security company to prevent a third-party attack, but also educated the company on how to fulfill that duty.
Nonetheless, with Allied guards at their posts, an unauthorized visitor gained access to the office tower, where he shot four people, killing three of them. Like the assailant in Aidroos, the visitor gained access to his targets by convincing the security guard at the front desk he had a gun and forcing the guard to escort him to the floor where the shooting occurred. Among other claims, the victims’ estates filed wrongful death and negligence actions against Allied.
The First District reversed summary judgment in Allied’s favor and ruled that it did have a duty to protect the decedents from the assault. The Court distinguished the case from Aidroos. There, the contract stated that the security company did not ensure any person’s safety and did not assume liability for the criminal acts of third parties. By contrast, in McKenna, the security protocols warned that workplace violence threatened tenants’ lives and offered instructions on how Allied could diffuse these situations. This encompassed the workplace violence that caused the tenants’ deaths.  Therefore, Allied had a duty to prevent the shooting.
Beyond distinguishing cases with similar fact patterns, a disclaimer or assumption is so influential it can even distinguish cases where security companies were hired to perform similar day-to-day functions. On this point, the comparison between Blankenship and Berg is instructive.
In Blankenship, Centegra Health Systems hired Securitas to provide security at its mental health facility in Woodstock. The contract and related post orders called for Securitas to conduct foot patrols and monitor the facility through closed circuit cameras its guards viewed in a secluded second-floor room. The contract also included a disclaimer, which stated that Securitas was not responsible for any “[c]laim, loss, damage or expense arising from…a violent or armed action.”
On July 16, 2004, an unstable patient entered the Woodstock facility, doused the receptionist with gasoline and set her on fire. Securitas guards arrived too late to save the woman’s life. The receptionist’s estate sued Securitas for negligence and wrongful death. But the trial court granted Securitas summary judgment, which the First District affirmed. The First District found no duty to prevent the incident because the contract disclaimed liability for injuries arising from a “violent action.”
On the other hand, the security company in Berg had similar job functions but a different duty. There, a property manager hired Allied Security to guard his office park. As in Blankenship, the contract and post orders required Allied to monitor the facility through foot patrols and closed-circuit cameras, which it viewed from the front desk. But unlike Blankenship, a post order conferred upon Allied’s guards a “duty to maintain a high level of visibility, the duty of constant vigilance, and the duty to keep unauthorized people from the property to reduce the risk of assault.”
One night, an unauthorized visitor assaulted an employee at the office park as she returned with a pizza for her co-workers. The employee sued Allied for negligence, contending its duty extended to preventing assaults like the one she suffered.
The Court held that, through its post orders, Allied explicitly assumed a duty to control access to the property and “reduce the risk of assault.” This encompassed keeping unauthorized people like the assailant off the property and reducing the chances of assaults like the one inflicted on the plaintiff.
So despite matching daily functions, which included foot patrols and closed-circuit monitoring, the guards in Blankenship and Berg were hired to prevent different types of incidents and, therefore, had different duties. This led to their opposite result.
Protecting People vs. Protecting Property
Duty can also depend on whether the security company contracts to protect people or, exclusively, to protect property. If it is the former, courts will find the company has a duty to prevent third-party assaults. Conversely, if it is the latter, there will be no such duty.
This doctrine traces its roots to Pippin, a 1977 Illinois Supreme Court case, and Hill, a 1992 First District case that distinguished it. Both involved third-party attacks at housing projects managed by the Chicago Housing Authority. But the people vs. property distinction led them to different outcomes.
In Pippin, the CHA hired Interstate Service Corporation “for the purpose of guarding [its] properties…and the protection of persons thereon.” Nonetheless, with Interstate guards nearby, a resident of Chicago’s Olander Homes stabbed and killed an acquaintance in the building’s lobby. Relying on its contract with the CHA, the Court ruled Interstate “assumed a duty…of exercising reasonable care in the performance of its contracted obligation of ‘protection of persons’.”
In Hill, the CHA hired Triad Security under an oral contract to provide security at the Cabrini Green Housing Project. The contract only required Triad to protect CHA property. Early one morning, Hill was shot in the lobby of one of the Cabrini Green buildings. His subsequent lawsuit alleged Triad was negligent for “allowing dangerous persons to loiter in the common areas and hallways, and in failing…to prevent such loitering and assaults on the plaintiff and others who were rightfully using the common areas.” Distinguishing the case from Pippin, the Court dismissed Hill’s claim because “Triad’s only duty was to protect CHA property.”
As a significant factor in the duty analysis, the people vs. property doctrine has endured. In fact, it contributed to the opposite results in Aidroos and McKenna, both of which relied on the comparison between Pippin and Hill. In Aidroos, the duty clause in Vance’s contract stated that its “principal function” was to “maintain a presence, observe and report” and it did not “insure or guarantee the personal safety of any person or the security of any property.” Based, in part, on this language, the Court determined Vance’s undertaking “did not create by implication a broader duty to protect Navistar’s employees from criminal attacks.” On the other hand, in McKenna, Allied’s contract included a duty to “insure the safety of all persons and property” at Ogilvie, which encompassed the “safety and protection of life.” Based on this language, the Court concluded that, through its contract, Allied-Barton “undertook a duty to protect life.” Other cases have based their duty conclusions on similar language, whether establishing or rejecting a security company’s duty to a plaintiff. So like assumptions and disclaimers, the people vs. property distinction can be the determinative factor in the duty analysis.
The Occasional Role of Restatement Section 324A
In determining whether the security company’s duty extends to the plaintiff, some courts have also considered Section 324A of the Restatement of Torts. This provides that
One who undertakes to render services to another, which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from failure to take reasonable care to protect his undertaking if
- Failure to exercise reasonable care increases the risk of harm
- He has undertaken a duty owed by the other to the third person, or
- Harm has suffered because of reliance by the other or the third person upon the undertaking.
Under this analysis, courts determine whether the company’s contractual duty satisfies any of 324A’s three conditions. If it does, the duty will extend to the plaintiff.
For example, in Pippin, the Court found that 324A(c) – reliance by a “third person” on the security company’s undertaking – conferred a duty on Interstate to protect the plaintiff from the stabbing. In its contract with the CHA, Interstate undertook a responsibility to supply “armed guards and other protective services for the purpose of guarding [the CHA’s] properties…and the protection of persons thereon.” The Court held that the CHA relied on this undertaking by forgoing additional safety measures at the housing project. According to the Restatement’s comments on subsection (c), this means that the plaintiff’s “harm results from the [defendant’s] negligence as fully as if [the defendant] had created the risk.” Based on this, the Court ruled that Interstate’s contractual duty to protect “persons” at Olander Homes extended to the plaintiff and the assault he suffered.
Notably, for the 324A analysis to apply, the contract must set forth a duty to protect people. This would seem logical. If the security company has no duty to protect people and the injured parties are people, its duty cannot extend to the plaintiffs.
Further, 324A’s importance is debatable, as courts have only applied it sporadically and, now, may be dropping it entirely. In Aidroos, for example, the Court conducted two separate analyses – one that relied on the contract exclusively and another that incorporated elements from 324A (both found Vance had no duty to the shooting victims). Between its two analyses, the Aidroos Court focused more attention on the contractual language. Indeed, the Court led with that inquiry and devoted more space to it than to all 324A’s subsections combined. More recently, courts have omitted 324A from their analyses. These include Blankenship – a 2014 case – and McKenna – a 2015 case. So while Section 324A is not extinct, at best, it is a supporting issue.
For negligence claims against private security companies, duty frames the issues. Luckily for security companies, it is an element they can control – at least somewhat. At the front end, they can insist on contractual language that makes their role clear and does not stretch beyond their capabilities. This will give them protection, as the duty element insures that companies are only held liable for failing to do what they agreed to do.
 Aidroos, 386 Ill.App.3d at 172; Blankenship, 2014 IL App. (1st) at ¶18.
 Aidroos, 386 Ill.App.3d at 173.
 In some of the cases discussed in this article, plaintiffs have filed wrongful death claims, either instead of or in addition to negligence claims. In Illinois, negligence and wrongful death claims are almost identical. They consist of the same three elements: (1) duty; (2) breach; and (3) injury stemming from the breach. Vaughn v. Granite City Steel, 217 Ill. App. 3d 46, 50 (5th Dist. 1991) (Wrongful Death); Blankenship, 2014 IL App. (1st) at ¶18 (Negligence). The only difference is that, in wrongful death actions, the “injury” causes death. So for efficiency’s sake, this article will refer to negligence and wrongful death, collectively, as “negligence.”
 Id. at 168.
 Id.at 169.
 Id. at 175.
 Id. at 174.
 Id. at ¶¶10-15
 Id. at ¶¶33, 47.
 Id. at ¶¶ 15, 31-33.
 Id. at ¶¶33-34.
 Blankenship, 2014 IL App. (1st) at ¶¶5-7.
 Id. at ¶¶5-6
 Technically, this language was in an amendment to the contract. Id. at ¶7.
 Id. at ¶9.
 Id. at ¶10.
 Id. at ¶¶25-26.
 Berg v. Allied Security, Inc., Chicago, 697 N.E.2d 769, 775-776 (First Dist. 1998), reversed on other grounds, 193 Ill. 2d 186 (2000).
 Id. at 775.
 Id. at 778.
 Aidroos, 386 Ill. App. 3d at 173-174 (Comparing Pippin v. Chicago Housing Authority, 78 Ill. 2d 204, 207 (1979) to Hill v. Chicago Housing Authority, 233 Ill. App. 3d 923, 930 (First Dist. 1992)); See Bourgonje v. Machev, 362 Ill. App. 3d 984, 1003 (First Dist. 2005) (Applying the people vs. property doctrine to a landlord’s duty to protect a plaintiff).
 Id. at 210.
 Hill, 233 Ill. App. 3d at 928.
 Id. at 930-931.
 Id. at 925. Though he was shot in the head, Hill survived.
 Id.at 935.
 Id. at 175.
 McKenna, 2015 IL App (1st) at ¶10.
 Id. at ¶33.
 See e.g. Berg, 697 N.E.2d at 777 (Finding a duty to protect the plaintiff, in part, because the security company contracted to protect third parties from assaults).
 See e.g. Phillips v. Budget Rent-a-Car Systems et al, 372 Ill. App. 3d 155, 164-165 (First Dist. 2007).
 A notable exception to the people vs. property doctrine is where security companies contract to protect people, but only during certain time periods. This was the situation in Cross. There, Wells Fargo Alarm Services entered into a contract with the CHA for the “protection of persons” at the Henry Horner Housing Project. Cross v. Wells Fargo, 82 Ill. 3d 313, 314 (1980). But the contract only required Wells to provide services from 9 a.m. and 1 a.m. each day. Id. At 1:15 a.m. one morning, the plaintiff was severely beaten in the Henry Horner Project’s lobby. Id. The Court ruled that, while Wells agreed to protect people, it only agreed to do so between 9 a.m. and 1 a.m. Id. at 318-319. So because the attack occurred outside that time, Wells had no duty to the plaintiff. Id.
 Restatement (2nd) of Torts §324A.
 Pippin, 78 Ill. 2d at 210.
 Id. at 207.
 Id. at 210.
 See Phillips, 372 Ill. App. 3d at 164-165 (Finding no duty of care and, in the process, holding that analysis under 324A was unnecessary because the contract only required security company to protect property)
 Aidroos, 386 Ill. App. 3d at 172-175.