09/20/2026
“No Legal Duty” Is NOT a Security Strategy: What the Allen Mall in TX Case Means for Our Profession
September 20, 2026
The Texas Supreme Court is being asked to decide whether the owners of Allen Premium Outlets had a legal duty to protect shoppers from the horrific 2023 mass shooting that killed eight people and injured seven others.
As a former Chief of Police, former CSO, Texas & Colorado Peace Officer, and someone who has spent more than four decades in this profession, and someone who helped investigate a "mass" shooting, I believe this case deserves the attention of every property owner, board member, security provider, and security leader.
Let’s be clear about what is—and is NOT—before the Court.
Nothing in this article questions the courage, effort, or professionalism of the security personnel or company (s), law-enforcement officers, first responders, or employees involved that day. This is about leadership decisions, risk governance, resources, and lessons for our profession—NOT assigning fault to people whose full circumstances and information we do not know, understand or appreciate!
And, one person deserves to be recognized by name: Christian LaCour, 20, the Allied Universal security guard alleged to have been the only guard on duty that day. He was unarmed. The lawsuit reports that he led at least one person to safety before he was killed. His name should never be reduced to a staffing number, a legal allegation, or a line in a case file. As security professionals, we recognize Christian’s bravery and sacrifice—and honor him for acting to protect another person in the face of unimaginable danger.
Also, Officer Dominique Akins of the Allen Police Department deserves to be recognized by name. Hearing gunfire while finishing an unrelated call at the mall, Officer Akins ran toward the danger, confronted the gunman, and ended the assault—an act for which he received the 2025 State of Texas Law Enforcement Achievement Award for Valor.
BUT, the shooter alone bears criminal responsibility for his evil acts. Let's be very clear about who owns this mass tragedy! Their name will NOT be mentioned!
The legal issue is whether the owners had a duty to take reasonable steps to protect people from foreseeable third-party criminal conduct. The plaintiffs allege that a 611,000-square-foot outlet property was protected by one unarmed security officer, that there had been extensive prior calls for service, and that a shooting-related call had occurred days before the attack. Those remain allegations to be tested in litigation—not established findings.
What will the Texas Supreme Court examine?
First, it will decide whether a legal duty existed—a question for the Court, NOT a jury. In Texas, the central issue in cases involving criminal acts by third parties is foreseeability: whether prior criminal activity made this type of attack sufficiently foreseeable that reasonable protective measures were required.
The Court traditionally considers the proximity, recency, frequency, similarity, and publicity of prior crimes, then balances the likelihood and seriousness of harm against the burden and social consequences of the proposed security measures.
Applied here, the alleged 3,000 calls for service do NOT, by themselves, prove that a mass shooting was foreseeable; the nature, location, timing, and similarity of those calls matter greatly. Likewise, allegations concerning prior shootings, staffing, communication capability, site design, and the owner’s knowledge will matter only to the extent they show a reasonably foreseeable risk and a reasonable measure that could have reduced it.
The Court could recognize a fact-specific duty without creating a blanket rule that every Texas mall must operate like an airport. That distinction is exactly why security leaders should pay close attention.
But the issue is bigger than any one mall, any one security provider, or any one lawsuit.
A courtroom may debate whether there was a legal duty.
Security leaders should be asking whether there was a professional duty.
“No legal duty” may be a courtroom argument. It cannot be the operating philosophy of a place that invites the public in.
That does NOT mean every mall, school, church, hospital, hotel, or entertainment venue must become an airport. It does NOT mean that metal detectors, armed guards, or cameras alone create safety. And it certainly does NOT mean any organization can guarantee that violence will never occur.
It means we must stop treating public-facing security as a commodity line item.
The real question is whether leadership has honestly assessed the risk, funded reasonable layers of protection, and created the ability to detect, communicate, respond, and recover.
One guard is NOT a security strategy.
A camera system nobody actively monitors is NOT a security strategy.
A policy binder sitting on a shelf is NOT a security strategy.
An annual tabletop exercise without communication, training, command structure, and a relationship with local law enforcement is NOT a security strategy.
A real strategy starts with intelligence: What is happening on and around our property? What do crime trends, calls for service, social-media threats, suspicious-activity reports, tenant concerns, and neighboring incidents tell us? Is the threat evolving?
It continues with a risk-based plan: How many people are on site? Where are the vulnerabilities? What is the response time? How will people receive actionable instructions? Who has command? Can law enforcement access live information quickly? Are the people at the point of contact trained, equipped, supervised, and connected?
And it requires relationships—before they are needed.
Security cannot operate in a silo. Property ownership, tenants, contract-security providers, local law enforcement, emergency management, legal, risk, insurance, and executive leadership all have a role. When a crisis occurs, nobody has time to exchange business cards, find the right radio channel, or discover that the emergency plan does NOT match reality.
The Framework Is NOT the Outcome
Our profession has no shortage of ways to assess and communicate risk. Security companies, consultants, experts, insurers, and internal teams may use different names, scoring models, heat maps, and worksheets, including:
Enterprise Security Risk Management (ESRM)
Enterprise Risk Management (ERM) and ISO 31000-style risk frameworks
Threat, Vulnerability, and Risk Assessments (TVRA)
Crime Prevention Through Environmental Design (CPTED)
NIST-style risk assessment and risk-management frameworks
Business-impact analysis, business-continuity, and crisis-management planning
Bow-tie analysis, failure-mode-and-effects analysis (FMEA), and other consequence-based models
Proprietary site-security assessments, guard-force reviews, risk matrices, and insurance-driven loss-control reviews
Each can be useful. None is magic. I've worked with them all........
Over more than four decades in law enforcement and corporate security, I have used every one of these approaches in one form or another—and have been formally trained or certified in many of them.
And let’s be honest: every one of us who buys, builds, or uses one of these tools tends to think our tool is the “sh*t”—better, smarter, and more complete than everyone else’s.
Maybe it is? But the real test is NOT whose framework has the best name, the most colors on its heat map, or the slickest report. The real-world test is whether it identifies the actual threat, produces clear and funded protective measures, trains people to use them, makes communications work, gives responding law enforcement what it needs, and reduces harm when it matters.
Use the methodology that fits your organization. But never confuse completing an assessment with managing the risk. The paper must translate into real-world readiness.
A Practical Standard: YES, S.I.R.
In my book, YES, S.I.R.: The Security Influencer’s Guide to Success Using Strategy, Intelligence, and Relationships, I share a simple, actionable methodology that applies directly to this moment and many others: Strategy, Intelligence, and Relationships.
Strategy means having a documented, funded, risk-based protection plan—NOT simply buying security officer hours, cameras and access control and hoping for the best. Leadership must establish the mission, risk tolerance, accountability, response objectives, and measures of success.
Intelligence means turning calls for service, crime trends, suspicious-activity reports, tenant concerns, online threats, site observations, and after-action lessons into accurate, actionable information. Data that does NOT change a security decision is simply data. Intelligence should drive the decision.
BTW: If your not using Artificial Intelligence (AI), you are about to be left behind in the security risk game, fyi.
Relationships mean building trust and operational alignment among ownership, security, tenants, local law enforcement, emergency management, and the community before an emergency. The middle of a crisis is a terrible time to discover that nobody knows who makes the call, who communicates, or how to work together.
This is NOT hindsight. It is the discipline of preparedness. The question every public-facing organization should ask is: Can we show that our Strategy was sound, our Intelligence was actionable, and our Relationships were ready to work when people needed us most?
Whatever the Court ultimately decides, the marketplace is already moving. Boards, insurers, juries, employees, tenants, and customers are asking harder questions:
What did you know?
When did you know it?
What risk assessment did you conduct?
What reasonable measures did you consider?
What did you fund?
How did you train and test the plan?
Can you explain your decisions?
The future of security will NOT be defined solely by a court-imposed standard. It will be defined by whether we, as security professionals, give our organizations clear, defensible, risk-informed counsel before tragedy forces the question.
We do NOT need to promise the impossible.
We do need to lead responsibly.
Strategy. Intelligence. Relationships.
That is how we protect people—and how security earns its rightful place at the executive table
This article addresses security leadership and risk management, NOT the legal merits of a pending case. Facts attributed to the parties remain allegations unless established in court. It is designed to stimulate thoughtful conversation about how we can always do better. We must discuss these incidents—NOT to assign premature blame, but to learn, improve, and strengthen security for the people who depend on us.
