Your business and liability for criminal acts

Best practices for managing the expanded risk presented by a recent Washington Supreme Court decision

Jamie Howsley

In a startling decision that greatly expands the liability of property owners and tenants, the Washington Supreme Court recently ruled that businesses must protect employees and other invitees from criminal conduct that is foreseeable based on the business’s past experience of similar criminal acts, and that such businesses are negligent if their failure to do so results in an injury, or damage to property.

A retail employee was injured during a shooting at the Tacoma Mall, and then sued the mall owner, alleging negligent failure to protect him from foreseeable criminal harm. The case is still being litigated ten years after the incident, and a federal court asked the Washington Supreme Court (“court”) to clarify state law on premises liability to invitees.

In surveying earlier cases, the court noted that the special relationship between a business and its invitees may lead to a duty to protect invitees from criminal acts, but that business owners generally are not responsible for the harm resulting from criminal acts on business premises. The court held that a business owner owes a duty of protection where they have prior experience with similar criminal acts. The court did not decide whether the mall owner was liable, but did note that the mall had no security cameras, there were four unarmed guards on duty, and they had not been trained to operate an intercom system that was inaudible and inaccessible on weekends.

What does this mean for property owners and tenants, especially of larger retail and multi-family properties? The first lesson is that if a damaging criminal incident occurs, the owner or tenant, or both, should increase security against that same type of event in the same location. For example, following an incident in a darkened parking area, install more lights.

The opinion is based on a crime in a public area of a shopping mall and does not address liability of multi-family property owners. However, this decision may encourage claimants to pursue property owners and any other businesses responsible for the premises where the injury occurred.

The court again rejects the idea that high crime locations automatically impose a duty on the business to protect its invitees, but the fact remains that businesses in higher crime areas will experience the criminal incidents that create the duty to protect, and this opinion is likely to increase litigation risks and security expenses in down market areas.

Businesses can take several actions to protect against these negligence claims. First, if an incident occurs, take prompt remedial action to improve security at the affected location. Second, confirm with your property and casualty insurance broker that your policy provides coverage against negligence claims of this type, and get additional coverage if necessary.

Businesses can also contractually agree on responsibility. For example, leases should specify that tenants are responsible for security within their exclusive premises, and for criminal acts of employees and vendors including the indemnification of landlords for claims made against them. Property management contracts can specify who is responsible for security staffing, procedures and equipment.

As in all negligence cases, the outcome will depend on the unique facts and circumstances of the property and businesses responsible for it. Be thoughtful and proactive to allocate the liability risks and costs, and clearly designate responsibility for security among the involved businesses. These are best practices for managing the expanded risk presented by this case, and defending against the wave of negligence claims that are sure to follow.

James Howsley is a Jordan Ramis PC shareholder and a member of its Dirt Law practice group. He focuses on land use and real estate while serving clients in Oregon and Washington. He can be reached at 360.567.3913 or

This site uses Akismet to reduce spam. Learn how your comment data is processed.