Mary DIFEDERICO, individually and as personal representative of the estate of Albert DiFederico; Nicholas DiFederico, individually; Erik DiFederico, individually; Greg DiFederico, individually, Plaintiffs-Appellants, v. MARRIOTT INTERNATIONAL, INC., Defendant-Appellee, 677 F. App'x 830

Unpublished opinions are not binding precedent in this circuit. GREGORY, Chief Judge: On September 20, 2008, Mr. Albert Di-Federico was tragically killed when terrorists attacked the Marriott Islamabad, in which he was staying. We now must answer whether the district court erred in finding that Marriott International, the hotel’s franchisor, was not liable for Mr. Di-Federico’s death. We find that the district court did not err, and therefore affirm. I. A. The Marriott Islamabad (“the Islamabad”) is a franchisee of Marriott International (“Marriott”).

It is owned and operated by Hashwani, Inc., a Pakistani company. On September 20, 2008, a truck carrying 1,320 lbs of explosives turned into the Islamabad’s driveway and crashed into the hotel’s fortified gate barrier, called a Delta barrier. The barrier stopped the truck from moving any closer to the hotel. Thirteen seconds later, the truck driver attempted to detonate the explosives. The detonator partially malfunctioned. It did not detonate the explosives in the back of the truck, but it started a fire in the front of the truck.

Security guards responded to the truck like an automobile fife, seemingly unaware that the back of the truck carried explosives. But the hotel did not notify guests of the fire. The security guards attempted to put out the fire using fire extinguishers, but were unsuccessful. Several minutes after the attempted detonation, the truck exploded. At the time, there were more than 1,500 people in the hotel. The explosion set fire to the fourth floor of the hotel and damaged the main water line used in the hotel’s sprinkler system. Mr.

DiFederico, a guest on the Islamabad’s fourth floor, died due to either the initial explosion or the subsequent fire. Overall, fifty-six individuals died in the attack, and 265 individuals were injured. Mr. DiFederico’s family brought a wrongful death and survival suit against Marriott. They did not name Hashwani as a defendant. The district court originally dismissed the case as forum non conve-niens, and the Fourth Circuit reversed and remanded that decision. DiFederico v. Marriott Int'l, Inc., 714 F.3d 796 (4th Cir. 2013). Plaintiffs amended their complaint twice before settling on a theory of liability.

They argued that Marriott, as franchisor, exercised sufficient control over the Islamabad’s security protocols to render it liable for Mr. DiFederico’s death. The district court denied Marriott’s motion to dismiss, and discovery occurred. After discovery, Marriott filed a motion to dismiss, or in the alternative, for

summary judgment. The district court granted

summary judgment in favor of Marriott. In doing so, it found that Marriott did not, exercise sufficient control over the Islamabad’s security operations to warrant liability. It also found, that Marriott was not liable under an agency by estoppel or apparent agency theory. Plaintiffs timely appealed. They argue solely that Marriott exercised sufficient control over the Islamabad’s security procedures—the instrumentality that led to Mr. DiFederico’s death. See Appellant Br. ,80, 38. B. To determine whether Marriott is liable for Mr.

DiFederico’s death, we must examine what control Marriott exerted over the Islamabad’s security. We first review Marriott’s relationship with franchisees generally, and then review its relationship with the Islamabad specifically. 1. Under the Marriott brand, there are hotels that are owned and managed by the Marriott; hotels that are managed, but not owned, by the Marriott; and hotels that are neither managed nor owned by the Marriott, but retain a franchise license to use the Marriott name.

In order to maintain a license to use the Marriott name, franchised hotels must adhere to a set of standards that Marriott establishes. For example, a franchised hotel must meet Marriott’s Crisis Management Standards (“Standards”). The Standards delineate the minimum security standards a franchised hotel must meet based on its level of threat risk. Marriott also has a Crisis Management Plan (“Plan”) that it requires managed hotels to meet. Unlike the Standards, however, franchised hotels need not adhere to the Plan.

Instead, the Plan is “distributed to franchised hotels ... because the contents of this 'manual may help the franchised hotels in developing or improving their Local Crisis Management Plan, even though some of the information in the Plan, such as the directions concerning who to contact within Marriótt International, are not applicable to hotels that Marriott International does not manage.” J.A. 376. • Similarly, Marriott-managed hotels operating internationally must meet Marriott’s International Lodging Crisis Plan (“International Plan”).

Franchised hotels receive the International Plan, but do not need to meet its requirements. Marriott audits its franchised hotels twice a year to ensure the Standards are met. But Marriott takes no further steps to ensure that the franchised hotels are safe.

The audit report itself is a one-page, double-sided, yes/no checklist with a short space for comments, confirming that the relevant security requirements, depending on the hotel’s threat condition, are met: for example, whether there is a current, local crisis management plan on file; whether anyone is taking photographs of the hotel; whether the roof access is locked. Marriott does not even have to review or approve a franchised hotel’s local crisis management plan. It just needs to know that the hotel has one. Marriott requires franchised hotels to send its employees to mandatory Marriott training programs.

These programs cover topics like hospitality, management skills, and conflict resolution. But Marriott provides franchised hotels with no training programs on security protocols or threat assessment. 2. The Islamabad is a franchisee of Marriott. As a franchisee, the Islamabad has to meet Marriott’s Standards. Hashwani, the company that owns and manages the Islamabad, also received Marriott’s Plan and International Plan, but it did not need to implement those plans. Hashwani is otherwise responsible for hiring, training, and managing the Islamabad’s security staff.

At the time of the bombing, the Islamabad was categorized as Threat Condition Red. Under the Standards, Hashwani had to “establish a comprehensive written local Crisis Management Plan” that addressed foreseeable natural and man-made disasters, and regularly review its plan with its local crisis management team and employees.

Hashwani also had to establish certain security measures at the Islamabad—for example, inspect its public restrooms at least hourly; refuse to store luggage; use metal detectors to screen all individuals entering the hotel; and require identification for all vehicles entering the hotel property. Marriott audited the Islamabad one month before the attack and found the Islamabad to be one-hundred percent compliant with its Standards. II. This court reviews a grant of

summary judgment de novo. Roe v. Doe, 28 F.3d 404, 406 (4th Cir. 1994).

Summary judgment is appropriate if, upon considering all of the evidence, “the court finds that the moving party is entitled to judgment as a matter of law.” Id. When evaluating the evidence, “[t]his court must draw all reasonable inferences in favor of the appellant.” Id. at 407. A. In Maryland, the principle of lex loci delicti applies to all tort claims. Wells v. Liddy, 186 F.3d 505, 521 (4th Cir. 1999). As a result, a court must apply the law of “the state where the last event necessary to make an actor, liable for an alleged tort takes place.” DiFederico v.

Marriott Int’l, Inc., 714 F.3d 796, 807 (4th Cir. 2013). Because the last event occurred in Islamabad, Pakistan, we must apply Pakistani law. Pakistani law allows liability for franchisors when the franchise agreement contains an express agency relationship or when the franchisor committed the injury-causing act by controlling the instrumen-talities of the injury. See The Fatal Accidents Act, Act No. 13 of 1855 (Pak.) (party that committed wrongful act or neglect, causing death of person, liable for damages).

The district' court found, and the parties did not dispute, that Pakistani law on this point was “consistent with those of the forum state, Maryland.” DiFederico v. Marriott Int’l, Inc., 130 F.Supp.3d 986, 992 (D. Md. 2015). Because neither party contested this finding, any objection to the use of Maryland law as identical to Pakistani law on this point is waived. As a result, we continue to rely on Maryland law to illustrate the Pakistani tort claim at issue. B. . Whether a franchisor controlled the in-strumentalities of an injury is a highly fact-intensive question.

No prior case can be perfectly on point, yet many may be analogous. We briefly review two. Although they arise from different states, both cases address the same question present in Maryland law. Cf. Stenlund v. Marriott Int’l, Inc., 172 F.Supp.3d 874, 884-86 (D. Md. 2016) (citing out-of-jurisdiction cases to illustrate application of Maryland law when examining whether franchisor controlled instrumentality that caused injury). In Allen v.

Choice Hotels International, Inc., a district court in South Carolina found that a franchisor was not liable for a fire that occurred at its franchised hotel, because the franchisor did not control its franchisee’s decision to install, or not install, certain fire extinguishing equipment. 409 F.Supp.2d 672 (D.S.C. 2006). The franchisor required “smoke and fire detection, fire extinguishing equipment, emergency exits, and emergency lighting that meet or exceed prevailing federal, state or local codes.” Id. at 677. It also recommended an emergency power generator and sprinkler system. Id.

But even then, “[t]he fact that [the franchisor] required such upgrades and could have required [the franchisees] to retrofit the hotel with sprinklers does not create a duty for [the franchisor] to require sprinklers as a protection against fire.” Id. at 676. Conversely, in Toppel v. Marriot International, Inc., a district court in New York found that material questions of fact existed over the degree to which Marriott controlled the instrumentalities that led to a guest’s injuries. No. 03 Civ. 3042, 2008 WL 2864302 (S.D.N.Y. July 22, 2008).

The plaintiff alleged that the hotel’s inadequate lighting, selection of carpeting that made it difficult to distinguish between the floor and stairs, and hotel menu placement caused her to fall down the stairs when she moved towards the menu to read it. Id. at *1. According to the franchise agreement, Marriott had already required the franchisee, upon acquisition, to increase the lighting and replace the carpet in the area where the plaintiff fell. Id. at *2. The agreement also indicated that the franchisee needed Marriott’s approval for any signage it hung. Id. at *9.

And Marriott employees inspecting the franchisee had to inspect the menus at restaurants and the lighting, signage, and carpeting in hallways. Id. at *10. Taking all of these facts together, the district court found that there were questions of material fact about whether Marriott controlled the instru-mentalities that caused the plaintiffs harm. Id. The facts here demonstrate that Marriott lacked sufficient control over the instrumentality leading to Mr. DiFederieo’s death—namely, the' Islamabad’s security protocols.

As discussed above, Marriott did require Hashwani to comply with certain standards in order to ensure that the Islamabad provided similar services as other Marriott-branded hotels. See J.A. 1031-56. The Islamabad’s management, for example, had to attend Marriott’s training on leadership skills and hotel management. And the Islamabad, like all franchised hotels, had to comply with the Standards. The hotel had to develop its own, local crisis management plan, and was audited twice a year for compliance with the Standards.

But that was the extent to which Marriott controlled the hotel’s security procedures, Marriott did not hire any of the Islamabad’s security employees. It did not provide any security training, either mandatory or optional, to the Islamabad’s employees. J.A. 291; 990-92; 1008-09, 1017-20. Contrary to Plaintiffs’ assertions, it did not develop or carry out a specific security plan for the Islamabad, It did not even review the Islamabad’s local crisis management plan, J.A, 987. Mr. Orlob, the Marriott’s Vice President for Security, did not know if the Islamabad had an evacuation plan at all. J.A, 472.

Marriott’s regional security director knew of no individualized security advice or training provided to the hotel. J.A. 291. Marriott’s vice president for the region in which the Islamabad was located had never even visited the hotel before the attack. J.A. 1004. And Plaintiffs do not argue that either adherence to or failure to meet any of the Standards’ required protocols caused Mr. DiFederieo’s death. The Islamabad’s relationship to Marriott is much closer to the franchisor-franchisee relationship in Allen than the one in Top-pel. Like Allen, Marriott required particular minimum security standards.

In Allen, the requirements were particular fire extinguishing equipment; here, the requirements were particular security measures based on the Islamabad’s threat condition. And like in Allen, Marriott made specific non-mandatory recommendations. ' The franchisor in Allen recommended, but did not require, a sprinkler system; Marriott gave the Islamabad its Plan and International Plan as guidance, but did not require adherence.

Thus, also like Allen, Marriott did not voluntarily undertake a duty to establish the Islamabad’s security measures, “but merely guarded its trademark by assuring uniform appearance and operation of hotels operating under the [Marriott] mark.”409 F.Supp.2d at 677. Conversely, in Toppel, Marriott required its franchisee to modify the carpeting and lighting in the area where the plaintiff was injured; had the right to approve or deny any signage the franchisee hung; and regularly inspected the very lights and carpets that allegedly caused the plaintiffs injury.

Here, Marriott required only minimal standards; it did not establish any comprehensive security plan for the Islamabad or any required security responses to fire hazards or bomb threats. In fact, Marriott explicitly required that Hashwani independently develop its own security plan, and had no review or approval procedure for the plan. It only inspected whether or not a plan was in place. “[C]ourts have granted

summary judgment in favor of the franchisor where the agreement specifically provides that the franchisee is to perform the activities or control the instrumentalities in question.” Toppel, 2008 WL 2854302 at *5. And here, unlike in Toppel, the franchisee—not Marriott—had control over the security procedures and training of employees involved in the bomb detonation and fire that killed Mr. DiFederico. Plaintiffs highlight three pieces of evidence that allegedly raise a question of material fact about whether Marriott exercised sufficient control over the Islamabad’s security protocols.

But closer review demonstrates that the evidence raises no such questions of material fact. First, Plaintiffs point to the International Plan, which states that a hotel should not sound the fire alarm after a bomb. See J.A. 666. But according to both the International Plan itself and the depositions of employees, that plan is not mandatory for franchised hotels. And Plaintiffs’ own expert states that there is no evidence that the Islamabad was following the International Plan’s recommendations. J.A. 1227.

Plaintiffs correctly note that the plan states that some of its elements “are the minimum standards” required for Marriott franchisees. But the plan also immediately directs franchisees to the Standards for all mandatory requirements. The entire International Plan cannot be rendered mandatory for franchisees merely because some of its recommendations match the Standards’ requirements. . Plaintiffs next rely on testimony Mr. Orlob gave to the United States House Committee on Homeland Security. In that testimony, Mr. Orlob explained Marriott’s Standards, and discussed the attack on the Islamabad.

He stated that the hotel was operating at Threat, Condition Red, that the hotel was using a Delta barrier, and that without those measures, far more people would have died. J.A. 1064-66. He concluded, “Our security measures saved hundreds of lives.” But he never stated that Marriott required the Delta barrier Hash-wani used or exercised any control over Hashwani’s security protocols beyond the Standards. Despite Plaintiffs’ arguments, a single “our” alone cannot demonstrate that Marriott controlled Hashwani’s security procedures, management, or training in any way. Plaintiffs lastly rely on an email sent by Mr.

Yin, Marriott’s Senior Director for Global Safety and Security for Asia Pacific. The email allegedly “described a detailed site review at the Marriott Islamabad, clearly demonstrating that Marriott’s role was not merely limited to providing a threat condition plan, but included an active role in ensuring that the localized security plan was implemented correctly.” Appellant Br. 32. But that email, sent five months after the terrorist attack and in preparation' for the Islamabad’s reopening, makes no indication that Marriott exercised a similar level of control before the bombing.

One final note: Marriott’s biannual audits to ensure compliance with.the Standards also do not give it sufficient control over the Islamabad’s security protocols. The audit looks for only those protocols necessary under the Standards, such as roof access and hourly inspections of public restrooms. Such limited auditing cannot give Marriott control over the instrumen-talities that led to Mr. DiFederico’s death.

See Stenlund, 172 F.Supp.3d at 884-85 (annual audits of casino attached to Marriott hotel for “guest experience, service delivery, integrity of games, maintenance and cleanliness,” conducted by Marriott subsidiary, did not give Marriott control over cord draped over casino stairs). III. Mr. DiFederico’s death was tragic. But ultimately, Hashwani—not the Marriott— had control over how Hashwani’s employees would respond to the fire or bombing that killed Mr. DiFederico.

Marriott never trained the Islamabad’s employees on how to respond to such a situation; it never established a plan for such a situation; it never even reviewed the plan that Hash-wani developed. As a matter of law, Marriott did not control the instrumentalities that led to Mr. DiFederico’s death. For these reasons, the district court’s judgment is AFFIRMED. . Maryland law also recognizes liability for a franchiser when it creates a "master-servant" relationship by exercising sufficient control over its franchisee's day-to-day operations.

Plaintiffs do not argue on appeal that Marriott exercised sufficient control to render Hash-wani its agent, and such a claim may not be possible under Pakistani law. See Marriott Supp. Mem. Ex. A, Affidavit of Ahsan Zahir Rizvi, ECF No. 135-1, at 2-3 (asserting that Pakistani law only recognizes liability under agency theory when contract agreement expressly creates agency relationship). For these reasons, we focus only on whether Marriott controlled the instrumentalities that led to Mr. DiFederico’s death. .

For example, the Standards require hotels under Threat Condition Red, like the Islamabad, to inspect all vehicles entering the hotel driveway, But Plaintiffs do not allege that this requirement, or failure to meet this require-jnent, caused Mr, DiFederico’s injuries. And given that the truck drove straight into the hotel’s gate barrier from the street, no security officer had the chance or obligation to inspect the vehicle before the attack.