MEMORANDUM AND ORDER ON DEFENDANT PROTECTION ONE’S MOTION FOR SUMMARY JUDGMENT
SAYLOR, District Judge.
This is an action by three bank employees to recover for personal injuries allegedly sustained in the course of a robbery of the bank. Jurisdiction is based on diversity of citizenship.
Defendant Protection One Alarm Monitoring, Inc. (“Protection One”) sells and monitors burglar alarm systems. In 1999, it installed a system at a branch of Commerce Bank where plaintiffs Deborah Davis, Ashley Lewos, and Heidi Kunkel worked. In 2002, the bank was robbed. Plaintiffs contend that defendant negligently designed, installed, and monitored the alarm system, and that those failures
were the proximate cause of injuries sustained in the robbery.
The intruder who robbed the bank entered through the rear door after the branch was opened in the morning by the three plaintiffs. It is undisputed that the bank’s rear door alarm did not malfunction during the robbery, in the sense that it failed to sound after being armed. It is also undisputed that when the plaintiffs disarmed the front door as part of the opening of the bank, the rear door alarm was also disarmed. However, the parties disagree about whether the alarm system should have been configured in that manner and the extent to which Protection One was required to inform the bank about the configuration.
Defendant Protection One has moved for summary judgment on the grounds that it owed no duty to the plaintiffs and, in any event, the plaintiffs have not identified any breach of duty. In the alternative, Protection One has moved for partial summary judgment based upon the limitation of damages clause contained in the Installation and Monitoring Contract it entered with Commerce Bank.
For the reasons stated below, the motion will be denied.
I.
Factual Background
The facts are set forth in the light most favorable to the plaintiffs.
A.
The Contract for the Installation of the Alarm System
In approximately 1999, Commerce Bank constructed a branch office at 11 Park Avenue in Worcester, Massachusetts. The bank’s comptroller, Barry Murchie, was charged with selecting a contractor to design, install, and monitor an alarm system for the branch. Murchie had no expertise in the security field.
After soliciting bids, Murchie performed walk-throughs of the branch with two alarm companies, one of which was Protection One. He ultimately chose the Protection One proposal.
Murchie was the sole Commerce Bank employee who dealt with Protection One in procuring the alarm system. There is no real dispute that the bank relied entirely on Protection One’s expertise in installing, designing, and configuring the system.
On April 7, 1999, the bank and Protection One entered into an “Installation and Monitoring Contract” (the “Contract”). Murchie signed the Contract on behalf of the bank. The Contract called for the installation of “an alarm system as described on the attached Schedule of Protection.” The Schedule of Protection, however, is simply a list of components (e.g., motion sensors and door contacts), with no description as to how the components were to be installed or configured. The Contract also required that the bank notify Protection One of any errors or omissions
within five days of installation and contained a limitation of damages.
At some point thereafter, Protection One installed an alarm system at the branch.
B.
The Rear Door of the Branch
The branch is a free-standing building in a commercial area. It has two exterior doors, a drive-up teller window, and several other exterior features, including an ATM machine, an after-hours deposit box, and several windows. One of the doors is in the front of the building, and is the door through which customers and employees normally enter and exit. The other door is at the rear.
The rear door is a painted steel door, without any window and without any exterior markings or signs. Viewed from the interior, it is at the end of a short windowless corridor in the part of the bank that is normally accessible only to employees, next to a utility room and a bathroom. The only marking of any kind near the door is a standard “EXIT” sign mounted on the wall above it. The door has a handle that rotates to open the door, rather than a push bar as often found on emergency exits.
Under normal circumstances, bank customers would not enter or exit the bank through the rear door. According to plaintiffs, they never observed any bank employee using the rear door.
C.
The Configuration of the System
The alarm system installed by Protection One is apparently programmable, so that different features may be activated in different ways, depending on the customer’s preferences. At the time of installation, the system was programmed so that when the bank employees opened the branch and disarmed the front door, the rear door was disarmed as well. Thus, during normal working hours, both doors were not alarmed.
The decision to program the system in that manner was apparently made by the Protection One employee who installed the system. It is unclear who that person was. It is also unclear why it was programmed that way; presumably, it was to permit bank employees to come and go through the rear door during working hours.
It is unclear whether the person who programmed the system on behalf of Protection One explained the configuration of the system to any employee at the bank. There is conflicting testimony about whether it was standard practice for Protection One service technicians to perform a “walk-through” of the customer’s facilities after installation to explain how the alarm system operated.
As noted, Murchie was the only Commerce Bank employee who dealt with Protection One in procuring the alarm system. He testified that he did not make the decision to program the system to disarm both doors simultaneously. He also testified that he was not told, and was not aware, that it was configured in that manner. Likewise, the bank’s Security Officer and the three plaintiffs all testified that they were not told and were not aware of the configuration.
Protection One does not give its customers documents detailing specifically how the alarm system is configured and programmed, although a general instruction booklet explaining how to arm and disarm the system may be provided. No such booklet was produced in discovery. As noted, the Contract lists the types of security features purchased, but does not indicate where the features are to be installed
or how the system will be configured.
Although the record is silent on the subject, it appears that the configuration was not readily ascertainable by looking at the keypad in the bank when arming or disarming the system. Had the rear door been opened at any point during working hours, it would have become readily apparent that the door was not alarmed; however, no one from the bank apparently ever opened the door.
Protection One contends that Commerce Bank was required to test its alarm system regularly pursuant to the terms of the Contract, the bank’s Written Security Program, and the Bank Protection Act of 1968, 12 U.S.C. § 1882.
However, it appears that the bank never tested the rear door alarm and that bank employees— including the bank’s Security Officer, who was charged with developing and implementing the provisions of the bank’s Written Security Program — merely assumed that the rear door was alarmed at all times.
D.
The Robbery
Plaintiffs Deborah Davis, Ashley Lewos, and Heidi Kunkel were all employees of the branch. On the morning of March 8, 2002, the three plaintiffs arrived at the bank and performed their standard opening procedures. In accordance with bank policy, Davis, the branch manager, unlocked the front door, entered the building, locked herself in, and turned the alarm off using the keypad while Lewos and Kunkel waited outside. After Davis inspected the premises and found no signs of an intruder, she unlocked the front door so that the other women could enter and re-locked it once they were all inside. Plaintiffs were not aware that the rear door alarm had been disarmed when Davis turned off the front door alarm.
Soon thereafter, an armed, masked intruder burst out of a closet near the rear door and ran into the bank lobby. He handcuffed plaintiffs, threatened to kill them while pointing his gun at their heads, and stole money from the bank’s vault. The intruder then fled through the rear door. At this point, plaintiffs hit multiple panic buttons to notify Protection One, who immediately alerted the police. Plaintiffs contend that they suffered a variety of physical and emotional injuries as a result of the robbery.
II.
Analysis
The role of summary judgment is “to pierce the pleadings and to assess the proof in order to see whether there is a genuine need for trial.”
Mesnick v. General Elec. Co.,
950 F.2d 816, 822 (1st Cir. 1991) (quoting
Garside v. Osco Drug, Inc.,
895 F.2d 46, 50 (1st Cir.1990)). The burden is upon the moving party to show,
based upon the pleadings, discovery, and affidavits, “that there is no genuine issue as to any material fact and that the moving party is entitled to a judgment as a matter of law.” Fed.R.Civ.P. 56(c).
Once the moving party has satisfied its burden, the burden shifts to the non-moving party to set forth specific facts showing that there is a genuine, triable issue.
Celotex Corp. v. Catrett,
477 U.S. 317, 324, 106 S.Ct. 2548, 91 L.Ed.2d 265 (1986). The court must view the entire record in the light most hospitable to the non-moving party and indulge all reasonable inferences in that party’s favor.
O’Connor v. Steeves,
994 F.2d 905, 907 (1st Cir.1993).
Each plaintiff asserts a count of negligence against Protection One. To maintain an action for negligence under Massachusetts law, a plaintiff must prove the following elements: (1) a legal duty owed by the defendant to the plaintiff; (2) a breach of that duty; (3) proof that the breach was the proximate cause of the plaintiffs injuries; and (4) actual damage or injury.
Heinrich v. Sweet,
308 F.3d 48, 62-62 (1st Cir.2002)
(citing Jorgensen v. Massachusetts Port Auth.,
905 F.2d 515, 522 (1 st Cir.1990)). Because “application of the reasonable person standard is uniquely within the competence of the jury,” summary judgment is rarely granted in negligence actions.
DeVaux v. American Home Assur. Co.,
387 Mass. 814, 819, 444 N.E.2d 355 (1983).
Protection One contends that it owed no duty to plaintiffs; that, assuming such a duty existed, it committed no breach; and that its actions were not the proximate cause of any injury, because the acts and omissions of the plaintiffs, the bank, and the intruder broke any causal.link between its conduct and the alleged injuries.
A.
Whether Protection One Owed a Duty to Plaintiffs
The alarm system at issue in this dispute was designed and installed pursuant to a contract between Protection One and the bank. It is undisputed that plaintiffs were not a party to that contract, and they do not contend that they were third-party beneficiaries. Compare
Lakew v. Massachusetts Bay Trans. Auth.,
65 Mass.App. Ct. 794, 798-800, 844 N.E.2d 263 (2006). Plaintiffs contend that Protection One nonetheless owed them a duty “to design and install an appropriate alarm system at the [bank].” Protection One contends, in substance, that its duty of care is defined entirely by the contractual relationship, and that therefore it had no duty (because none is set forth in the Contract) “to install a 24-hour alarm on the rear door of the branch.”
It is well-established in Massachusetts that one who assumes an obligation under a contract has a duty of reasonable care in the performance of the obligation and is liable to third parties who are foreseeably exposed to danger and injured as a result of any negligent failure to carry out that obligation.
See, e.g., Anderson v. Fox Hill Village Homeowners Corp.,
424 Mass. 365, 367-68, 676 N.E.2d 821 (1997);
Parent v. Stone & Webster Eng’g Corp.,
408 Mass. 108, 114, 556 N.E.2d 1009 (1990);
Banaghan v. Dewey,
340 Mass. 73, 80, 162 N.E.2d 807 (1959);
see also
Restatement (Second) of Torts § 324A (“One who undertakes ... to render services to another which he should recognize as necessary for the protection of a third person or his things, is subject to liability to the third person for physical harm resulting from his failure to exercise reasonable care to protect his undertaking, if ... (b) he has undertaken to perform a duty owed by the other to the third person, or (c) the harm is suffered because of reliance of the other
or the third person upon the undertaking.”).
The Massachusetts Appeals Court has specifically recognized that a provider of security services under a contract owes a duty of reasonable care to its customers’ employees.
See Lakew,
65 Mass.App. at 801-02, 844 N.E.2d 263. In
Lakew,
the plaintiff was a parking attendant employed by a garage operator that had contracted with the defendant to obtain professional security services. The plaintiff was attacked and robbed when he opened his office door to an assailant. The court determined that although the plaintiff was not an intended beneficiary of the contract between the garage operator and the defendant, the defendant nonetheless owed a legal duty to the plaintiff, and could be held liable in negligence where “the plaintiffs injuries were a foreseeable consequence of the [defendant’s] failure adequately to perform its obligation to provide security.”
Id.
at 801, 844 N.E.2d 263.
Here, the Contract between Protection One and the bank is somewhat vague, leaving the precise nature of defendant’s obligations in some doubt. The Contract called for the installation of “an alarm system as described on the attached Schedule of Protection.”
The Schedule of Protection, however, is simply a list of components, with no description as to how the components were to be installed or configured. Under ordinary circumstances, the Court would have no difficulty concluding that the Contract also contained certain obligations implied by law, such as warranties of merchantability and fitness for a particular purpose.
Thus, ordinarily and at a minimum, Protection One would be deemed to have undertaken an obligation to install an alarm system that was designed, installed, and configured in a way that was appropriate for that bank at that particular location.
What complicates matters here is that Protection One, under the Contract, expressly disclaimed any warranty of merchantability or fitness for any particular purpose.
It is therefore at least arguable
that Protection One did
not
have a contractual duty to install and configure an alarm system that was fit for its intended purpose, or indeed to do much of anything, other than to install a system using the identified components. Furthermore, the argument goes, having undertaken no such contractual duty, Protection One had no tort duty arising out of the performance of any such contractual duty.
Although the argument has some superficial appeal, it must be rejected. First, under Massachusetts law, the presence of a disclaimer does not preclude an action for breach of warranty against the seller by an employee of the buyer who has suffered a personal injury.
See Ferragamo v. Massachusetts Bay Trans. Auth,
395 Mass. 581, 590, 481 N.E.2d 477 (1985). Put simply, the injured parties cannot be bound by a disclaimer that they never saw and to which they never agreed. Second, and more broadly, the scope of defendant’s duty to exercise due care cannot be limited merely to the precise boundaries of its contract, but instead are defined by the scope of the undertaking it is performing — here, an undertaking to install an alarm system for a bank at a particular location.
See
Restatement (Second) of Torts § 324A (using the word “undertaking” rather than “contract”). The contract, of course, ordinarily defines the undertaking, but the congruence between the two need not be perfect. Were the rule otherwise, the ability of an injured party to recover would rise or fall based on the exact language of the contract (or indeed whether the parties had formed an enforceable contract at all) rather than whether the party performing the undertaking had exercised due care.
Accordingly, under the circumstances, Protection One clearly owed a duty to third persons who could be injured as a reasonably foreseeable result of its failure, if any, to provide an appropriate security system for the bank. Whether it was reasonably foreseeable that bank employees might be injured as a result of the particular configuration of the alarm system, or as a result of defendant’s failure to notify the bank of the configuration, are questions for the jury.
B.
Whether Protection One Breached Its Duty of Care
Protection One next contends that it did not breach any duty of care it may have owed to the plaintiffs. It is certainly true that there is no evidence that the alarm system was defective in the sense that it did not do what it was programmed to do. And it is also true that the contract did not require a particular alarm configuration, and the bank did not request one. Finally, it is true that at least some forms of testing would have revealed the configuration. That does not, however, end the inquiry.
It is apparently undisputed that the bank relied upon Protection One to design and install an appropriate alarm system for the bank. According to plaintiffs, Protection One installed a system that was
programmed in an unusual and counterin-tuitive way, so that it did not work as a reasonable bank employee would have expected. When the front door was disarmed — which obviously needed to be done every morning — the rear door was also disarmed, even though it was for all practical purposes only an emergency exit. Furthermore, again according to plaintiffs, no one from Protection One told anyone from the bank how the system was configured, and there were no diagrams or manuals showing the configuration. Nor could plaintiffs have readily ascertained the problem; the configuration was not obvious from looking at the keypad, nor would routine testing necessarily have revealed the problem.
The question thus becomes whether those facts, if proven, would suffice to demonstrate a breach of duty by Protection One. The parties have not directed the Court to any case law precisely on point; instead, the cases cited by the parties involve express contractual provisions or factual circumstances not present here. Other cases addressing the alleged negligence of alarm companies involve express misrepresentations.
Thus, for example, in
Brinks Signal Co. v. Criswell,
245 So.2d 265 (Fl.Dist.Ct.App. 1971), the court held that the defendant alarm company was not negligent after a robbery where the plaintiff store owner had rejected an expensive alarm system that would have detected the intrusion in favor of a cheaper one. The contract explicitly stated that the system would not protect concrete ceilings such as the one through which the intruder cut a hole and entered the store.
Id.
at 265. Here, by contrast, the contract between Protection One and the bank simply does not address the configuration of the system.
Similarly, in
Elizabeth E. v. ADT Security Systems West, Inc.,
108 Nev. 889, 839 P.2d 1308 (1992), a restaurant employee was sexually assaulted after attempting to press two keys simultaneously on the alarm system’s keypad — a maneuver the restaurant manager told her would transmit a panic signal to the alarm company. Although the employee’s manager testified that a representative of the alarm company told her a panic signal could be transmitted by pressing the two keys, the alarm system was not configured in such a fashion. The court held that the defendant owed her a duty not to misrepresent the capabilities of the alarm system because it was foreseeable that restaurant employees
“would rely on the availability and effectiveness of the panic function during times of emergency.”
Id.
at 1311. Here, in contrast, there is no evidence that Protection One made any affirmative misrepresentations of any kind.
Notwithstanding the apparent absence of directly relevant case law, the evidence is sufficient to defeat summary judgment on the question of breach. A jury could reasonably conclude that (1) Protection One held itself out as an expert in designing and installing alarm systems; (2) the bank reasonably relied on Protection One to determine which type of alarm system should be installed in the bank and how it should be configured; (3) the configuration of the alarm system selected by Protection One was unreasonable under the circumstances, in that it left the rear door vulnerable to incursions during the work day; (4) the configuration was not obvious to the bank, and not affirmatively disclosed by Protection One; and (5) it was reasonably foreseeable to Protection One that the configuration would endanger the safety of bank employees. Put another way, the system as programmed could be said — not unreasonably' — -to have a hidden “defect” that was not obvious to the customer. On the present record, and viewing the entire evidence in the light most favorable to the non-moving party, that evidence is sufficient to establish a breach and thus survive summary judgment.
C.
Whether Any Breach
Was
the Proximate Cause of the Injuries
Next, Protection One argues that both the negligent failures of the bank and the intentional act of the intruder were superseding causes that relieve it of liability for whatever breach of duty it may have committed.
Defendant first argues that the bank negligently failed to test the system after it was initially installed, and that the configuration would have become immediately apparent had it done so. However, as a general matter, the “failure of a third person to act to prevent harm to another threatened by the actor’s negligent conduct is not a superseding cause of such harm.”
Solimene v. Grauel,
399 Mass. 790, 795, 507 N.E.2d 662 (1987),
quoting
Restatement (Second) of Torts § 452.
Furthermore, where the circumstances raise the possibility that a defendant should be relieved of liability for his negligence because of an intervening act and “there is room for reasonable differences of opinion as to whether such act was negligent or foreseeable,” the factual determination should be made by a jury.
Solimene,
399 Mass, at 795, 507 N.E.2d 662
(quoting
Restatement (Second) of Torts § 453 cmt. b).
Protection One notes that the bank had both a legal duty and a contractual duty to test the system, and that there is no evidence that any tests were ever performed on the rear door alarm. Even assuming that is true, it does not absolve Protection One from liability as a matter of law, particularly as to defects that were inherent in the system as installed (as opposed to those that may have arisen over time). Furthermore, and as noted, it is far from clear whether normal testing of
the system would have revealed the alarm system configuration to the bank. Presumably the bank could have tested the system by arming it (including the rear door alarm) and then determining whether the system responded to incursions (e.g., by opening the rear door and seeing if an alarm sounded). Such a test would not have revealed how the system was configured when it was partially disarmed.
Protection One further argues that the intentional act of the intruder constituted a superseding cause for which it cannot be held responsible. That argument, however, runs directly contrary to Massachusetts law. It is true that, as a general matter, “there is no duty to protect others from the criminal or wrongful activities of third persons.”
Mullins v. Pine Manor College,
389 Mass. 47, 50, 449 N.E.2d 331 (1983). But as the Supreme Judicial Court observed in
Gidwani v. Wasserman,
373 Mass. 162, 166, 365 N.E.2d 827 (1977):
Under normal circumstances, in the absence of any reason to expect the contrary, the actor may reasonably expect that others will obey the criminal law. Generally, the act of a third person in committing an intentional tort constitutes a superseding harm to another resulting therefrom, even though the actor’s conduct created a situation which afforded an opportunity to the third person to commit such a tort or crime. However, liability will be imposed where the actor realized, or should have realized, the likelihood that such a situation might be created, and that a third person might avail himself of the opportunity to commit a crime.
(citations omitted);
see Poskus v. Lombardo’s of Randolph, Inc.,
423 Mass. 637, 639-40, 670 N.E.2d 383 (1996);
Fund v. Hotel Lenox of Boston, Inc.,
418 Mass. 191, 192, 635 N.E.2d 1189 (1994);
Mullins,
389 Mass, at 62, 449 N.E.2d 331. Indeed,
Gid-wani
involved a burglary that occurred after the defendant deliberately disconnected an alarm system; the SJC observed that “[a] burglary may be a natural, reasonable, and probable consequence of a defendant’s disengaging an alarm which is placed on the premises for the sole purpose of protecting against such acts.”
Id.
at 167, 365 N.E.2d 827.
Finally, Protection One argues that the bank’s rear door did not have a tamper-resistant lock at the time of the incident, and that the bank’s negligent failure to install such a lock also constitutes superseding negligence. Even assuming that to be true, again it simply raises a jury question as to whether the bank negligently failed to guard against reasonably foreseeable criminal conduct and, if so, whether that failure constituted a superseding cause relieving defendant of liability.
Of course, alarm companies are not the insurers of their customers or their employees, and liability by no means flows inexorably from the fact of a criminal intrusion into an alarmed property. Furthermore, in this case, the chain of causation from the alleged acts or omissions of the alarm company to the injuries to the plaintiff is far from clear. Nonetheless, whether the alleged negligence of the bank or the intentional act of the intruder constituted superseding causes absolving Protection One from liability are questions of fact for the jury.
D.
Whether Plaintiffs Are Bound by the Limitation of Damages Clause
Finally, Protection One argues that a “Limitation of Damages” clause in the contract it signed with Commerce Bank should be binding upon plaintiffs. It relies upon an earlier opinion of this Court that questioned whether bank employees should be considered “third parties” within
the meaning of the contract’s indemnification clause.
Defendant argues that if the bank employees are not “third parties” with regard to the indemnification provision, they must be parties to the contract itself. Clearly, this interpretation is illogical. It would mean that any person would be considered a “party” to the contract and bound by its terms if he did not have property in the bank’s custody, regardless of whether he was even aware of the relationship between Protection One and the bank. As with other types of contracts, a plaintiff who is not a party to an alarm security contract, and never consented to its terms, can not be bound by its limitation of damages clause.
See Young v. TriEtch, Inc.,
790 N.E.2d 456 (Ind.2003) (reversing grant of summary judgment because limitation of liability clause between store and alarm company did not apply to decedent employee’s claims against alarm company);
Robbins, Inc. v. AFA Protective Systems, Inc.,
223 A.D.2d 352, 636 N.Y.S.2d 290 (N.Y.App.Div.1996) (reversing the dismissal of tenant’s case against alarm company because plaintiff was unaffected by liability limitations contained in contract between alarm company and building owner). Accordingly, plaintiffs are not bound by the contract’s limitation of damages provision.
III.
Conclusion
For the foregoing reasons, the Motion for Summary Judgment of defendant Protection One Alarm Monitoring, Inc., under Fed. R. Civ. 56 is DENIED.
So Ordered.