In Pa., private security companies make their own rules. Some say they’re above the law.

All William Grant wanted was to buy flowers for Mother’s Day at the ShopRite at Front and Olney.

Then he encountered the store’s security guard, William Hagin.

Hagin accused him of shoplifting — and tried to snatch the flowers from his hand. Grant pulled back. And then, he said, Hagin attacked him.

“I didn’t realize I was stabbed,” Grant, a 52-year-old father of four, said of the 2022 assault, “until I saw the blood shooting out.”

Hagin, it turned out, had a pocket knife as well as a criminal record, including convictions for assault and disorderly conduct. Even so, under Pennsylvania law, he was able to be hired as an unarmed security guard.

He was part of a booming industry that has encountered unprecedented private- and public-sector demand amid mounting concerns about violent crime and retail theft, and a police staffing crisis. Mayor Cherelle L. Parker, in her budget address, pledged $5 million to increase city spending on private security to new highs. Allied Universal, the Conshohocken-based security giant, is now one of Philly’s 15 largest employers.

This boom has coincided with a run of violent episodes in which security guards shot, punched, choked, or stabbed customers and passersby. One private security company has been sued about a dozen times for assaulting patrons at Philly bars, including a beating that left a 41-year-old man dead. And, people working as guards with what they described as minimal training have also been placed in dangerous positions — notably the high-profile stabbings of two security guards by an alleged shoplifter at the Center City Macy’s.

» READ MORE: The family of the security guard fatally stabbed inside Macy’s is suing the store

Yet regulation of the industry in Pennsylvania remains scant and scattershot, an Inquirer investigation has found — creating an anything-goes climate that experts say puts everyone involved at greater risk.

“You have probably the most archaic legislation in the country,” said Anthony Gentile, associate director of the Center for Private Security and Safety at John Jay College of Criminal Justice in New York.

Pennsylvania is one of just 10 states that has no statewide licensing board for security guards. Although a barber in Pennsylvania must be licensed and log 1,250 hours of training, unarmed guards need no training at all. Armed guards need just 40 hours.

The patchwork of state rules that does exist applies only to certain guards in certain work contexts — and they are rarely enforced, according to security providers. They’re confusing even to law enforcement personnel, who say county-by-county licensing creates hazy jurisdictional lines.

Some of the state’s regulations seem arbitrary: Unarmed guards working directly for a store, bar or other business, like Hagin was, are entirely unregulated — whereas security companies hiring for the same positions must navigate strict background-check requirements, such as a lifetime ban for people with felony records.

» READ MORE: Security guards sue over 'unconstitutional' ban on employment for people with criminal records

Other local regulations, such as Philly’s locally mandated 16-hour “bouncer certification program,” are largely ignored.

This culture of impunity has also emboldened guards to make up their own rules, work without licenses, or even style themselves as private police.

Some who have attained armed-guard certification from the state police advertise themselves as “state agents” — putting that title on DIY badges or on placards they use to park illegally on Center City sidewalks.

Over the last year, AR-shotgun-toting security guards patrolling Philadelphia’s gas stations and cheesesteak shops have made national headlines — often featuring Andre Boyer, an ex-cop who has appeared repeatedly on Fox News holding a military-style weapon. Overlooked in that coverage was the fact that Boyer’s gun license was revoked in 2016.

Yet, Boyer believes he’s found a loophole allowing him to run a “private police” force, because he has an armed-guard certification from the state police.

“We’re going to stop. We’re going to detain,” he said. “If you stole something, you’re going to be arrested.”

Steve Amitay, who heads the National Association of Security Companies, a trade group, said Pennsylvania is also a “big-time outlier” for allowing armed guards to carry assault-style rifles, which he called “crazy.”

“In most states, there is strict regulation as to what kind of weapons security guards can carry,” he said.

Industry experts estimate that at least 85% of security guards are unarmed — such as Hagin, the ShopRite security guard, was supposed to be. In Pennsylvania, unarmed guards are not required to have any certification, license, or training.

That omission “sticks out like a sore thumb,” Amitay said. Some companies will train on their own, he said, but “there should be a floor.”

Grant is one of at least four people to sue Shoprite since 2020, claiming abuse by its Philadelphia security staff. One woman said a guard in Port Richmond “lifted me up in the air, to the approximate height of his shoulders, and threw me downward like a sack of potatoes,” according to a lawsuit. Another customer, in Nicetown, said a guard forced him to strip to prove he hadn’t stolen merchandise. Last August, a woman attempting to exchange a box of diapers said a guard at a South Philly ShopRite threw her to the ground and broke her ankle.

After stabbing Grant, Hagin was charged with aggravated assault. Last week, he was sentenced to three to six years in state prison. He declined an interview.

The only consequence his employer, Collins Family Markets, faced is civil liability. The company hired a lawyer to defend Hagin in his criminal case. Supermarket owner Larry Collins and the lawyers representing the local ShopRite chain in the civil case did not respond to requests for comment.

“Instead of firing him and distancing themselves from him,” Grant’s lawyer Theodore Levy said, “they keep him on, let him continue to work with customers and hire him an expensive defense lawyer to try to help him beat the charges.”

While the U.S. security industry employs more people than ever before, according to the Bureau of Labor Statistics, Pennsylvania’s law regulating private security has changed little over the last century — despite decades of calls for modernization.

The legislation, called the Private Detective Act of 1953, was designed to regulate paid strike breakers, like the Pinkertons, following periods of violent labor unrest.

Today, in Pennsylvania, security companies such as Allied are still regarded by the state as private detective agencies.

To get a detective agency license, a company must petition in the local court. Exact requirements vary from county to county, but the law requires three years “investigative” experience, statements from five “character witnesses,” and a $10,000 bond.

Armed guards must be certified through a separate process, known as Act 235, handled by the Pennsylvania State Police. Applicants must pass mental and physical screenings, a background check, and a 40-hour training course.

In some cases, an applicant can be rejected as unfit by one authority, but licensed or certified by another.

The chaotic system has driven some to skip these steps altogether, according to Duztin Watson, an Army veteran and owner of the Pittsburgh-based security company RiP Group.

“You’ve got people just getting ‘Security’ put on T-shirts they bought off Amazon,” he said. “It’s very bothersome to us because we pay for the licensing, we keep our business straight, we follow the rules. … People with no accountability are taking contracts from us.”

Last year, 92% of Act 235 applications were approved by the state police. The state police do not keep a public directory of the state’s 16,000 certified armed guards, or track when they use their weapons or are fired from their jobs for cause.

That has led to situations in which it isn’t obvious, even to security professionals, who is following the rules.

Some established security providers consider the arduous licensing process to be essentially optional.

Darren Watson, who said he has provided security for local charter schools and for popstar Doja Cat, said he’s never bothered to get a detective agency license. He runs his own company, Born 2 Protect, but said he’s been able to work under his father’s license for decades.

He said many unlicensed security guards don’t bother to seek such affiliations. Only 167 agencies or individuals are licensed in Philadelphia, where security is among the top-15 employment sectors.

“There is a lot of freelancing in Philly,” he said. “I don’t think they’re necessarily breaking the law — and, if there is one, it’s not being enforced.”

It has also paved the way for some state-certified armed guards to proclaim themselves above local law.

In 2013, an off-duty security guard who shot and killed a man during an argument on a Philadelphia street was charged with carrying a gun without a license and impersonating a police officer. He claimed his Act 235 certification was a substitute for a Pennsylvania gun license.

Pennsylvania’s Superior Court rejected that reasoning.

Yet, some armed guards working without gun licenses in Philly still echo his claim — and face no apparent repercussions.

Duztin Watson said fly-by-night operations can work without a license or any training.

“The question is: Who’s checking?” Watson said. “In Ohio, where we also work, they will literally come at you and check you. And you’re paying a daily fine for violations.”

In Pennsylvania, the sector is still expanding. The Bureau of Labor Statistics counts 40,500 guards statewide and Philadelphia tax data show a field growing by 10% a year. The city, SEPTA, and the airport combined are pouring at least $20 million a year in public money into contract security — at a time when city agencies have failed to fill hundreds of law enforcement positions. SEPTA now spends $6 million a year on security contracts, in addition to its $33 million transit police force.

Often, those security staffers must serve as a stopgap.

Last year, the city spent $3.8 million just to secure homeless shelters. Katrice Butler, who worked security for a shelter in Kensington, said that much of her time was spent “helping people not die” by administering naloxone, the overdose-reversal drug. “I can’t even count [how many doses],” she said.

» READ MORE: How Philly's Office of Homeless Services overspent its budget by $15 million

Yet, haphazard regulation and lack of training has created precarious situations — for the public and for security staffers.

Last year alone in Philadelphia, two security guards were shot at, one was bitten by an off-duty police officer, and at least three were stabbed — including Eric Harrison, who was killed while working at Macy’s. Harrison’s family said his killing, by a shoplifting suspect who was permitted to leave and then returned, could have been prevented by a better trained security force.

And a 19-year-old college student was raped while working a night shift alone and unarmed at a Center City parking garage. In her lawsuit, she said she received a week of training, covering such things as what to do if she caught someone breaking into a car. The “training, however, did not address any situations which involved her coming under any physical attack.”

Last year, a North Philly gas station owner sparked a news sensation when, after a string of robberies, he enlisted security contractors wielding scoped AR-15s to guard his parking lot.

The men wore bullet-proof vests, tactical belts, and badges reading “Special Agent” or “State Agent.”

They were Pennsylvania SlTE State Agents, headed by Andre Boyer — the ex-cop who lost his Philly license to carry firearms eight years ago.

» READ MORE: Ex-cop Andre Boyer's contentious history with the Philly police goes back a decade

He does not have a private detective license in Philadelphia, either. Judges ruled that he “did not meet the character and experience requirements,” according to a Superior Court opinion.

But Boyer said he doesn’t need a license because he doesn’t run a security company — he runs a “protection agency.”

Boyer and his AR-wielding employees are certified under Act 235, he said. He interprets that as not only substituting for a Pennsylvania license to carry, but as being deputized by the state police.

“The state police are the ones who issue us the license to carry, to do what we do, and only the state police can take it away from us,” he said, adding that if local police demanded proof of his Act 235 certification they’d face a lawsuit.

Lt. Adam Reed, a communications officer for the Pennsylvania State Police, said Act 235-holders such as Boyer are not “state agents,” and are subject to the authority of local police. He said they must carry their certificate, and display it to police upon request.

Boyer says it’s essential that his staff is armed with every tool that police have: handcuffs, drones, trained canines, pepper spray, Tasers, and, of course, guns.

He contrasted their work to that of security guards, who often are instructed by employers not even to verbally address shoplifters. His staff, he said, are empowered to make “citizen’s arrests.”

But his weapons have also gotten him into trouble. He’s been arrested three times since 2019, twice on gun charges and once for assault after stunning a person with a Taser during a citizen’s arrest. The cases were all dropped or dismissed.

In December, Boyer posted a video from a convenience store in North Philadelphia, showing a person handcuffed with zip ties. He said he was waiting for the police to pick up the suspect.

“We made seven arrests tonight,” he said. “These guys were coming in here, robbing this place, stealing it blind, but they didn’t expect the plainclothes unit to catch ‘em.”

The Philadelphia Police said they process Boyer’s calls just as they would those of any other security guard. They consider him to be a witness. A spokesperson confirmed that the department did make one arrest from the store on the night in question, and issued the person a summary citation for retail theft.

The District Attorney’s Office, in court filings, suggested that Boyer was the lawbreaker.

“Since he was fired from the police force,” the office wrote in one case, “Boyer has gone to great lengths to emulate his former profession, even if it means carrying a firearm without a license and performing unlicensed security work,” and noting he had “narrowly escaped criminal consequences.”

On April 3, 2022, John Donegan, a college football quarterback, was standing by the dance floor of the Center City bar U-Bahn when a security guard ordered him to move. In the crowded space, Donegan didn’t move fast enough.

The guard, from a Philadelphia company called Mainline Private Security, grabbed Donegan by the neck and, according to a lawsuit that later was settled out of court, “sucker-punched” him, leaving him with a concussion, fractured tooth, and separated shoulder.

The violent encounter was hardly unusual for Mainline, court filings show.

It was not even the only assault by guards at U-Bahn that night. Just an hour later, a guard choked a man until he lost consciousness.

Since 2018, Mainline and its staff have been sued at least 11 times for assaulting Philadelphia bar patrons — even allegedly beating a quadriplegic man and throwing him from his wheelchair.

One guard, Kenneth Frye, is facing a manslaughter charge in the death of Tabu patron Eric Pope, 41.

At least two other Mainline staffers have been prosecuted for assaults. Both had felony records, for illegal gun possession or aggravated assault, that should have barred them from the jobs.

Even so, Mainline has retained its license.

The biggest threat to the 12-year-old company, court filings indicate, is the mounting cost of civil litigation. Mainline had just $250,000 in insurance coverage for assault-and-battery claims, co-owner Brett Kern said in a deposition. That money was quickly “eroding,” he said — indicating the company’s financial footing was in question.

» READ MORE: After the death of Eric Pope, questions arise about Mainline Private Security

Kern did not respond to calls and emails.

Robert McCrie, a professor at John Jay College of Criminal Justice, said it was “distressing” to see so many allegations against a single company. But it’s not surprising to see violent encounters concentrated in bars. Working where alcohol is served, he said, requires “training in restraint and tension-reducing skills.”

He said state regulation — including substantial minimum insurance requirements — are needed to protect the public in such situations.

In 2011, after the Daily News exposed a series of bouncer horror stories — including an assault that left a patron in a vegetative state — the city enacted its own bouncer certification requirements. Bouncers had to complete a 16-hour training course covering alcohol management, de-escalation, first aid, and more.

Mainline’s Kern, in his deposition, admitted that some of his bouncers were not certified under the city law — including one later convicted of assault.

Russell Kolins, a security expert who developed the training, said that the city had “no real intent” of enforcing the law.

City records show no violation notices for uncertified bouncers in the last five years. The directory of city-approved training programs is filled with dead phone numbers.

The two remaining city-approved trainers said they encounter little demand.

“It’s been very, very sparse — almost nonexistent,” said one, Ed Iannucci.

A spokesperson for the Parker administration said in an email that it “is committed to a much stronger focus on these kinds of quality-of-life and nuisance issues, with resources and staff, and that includes issues such as the bouncer certification process. The city can do better, and it will.”

Today, calls for reform are coming from almost every direction.

The Pennsylvania Association of Licensed Investigators, a trade group, is pushing to create a statewide licensing system, according to John Sancenito, the association’s legislative chairperson.

The goal, he said, is creation of separate state licensing boards for security agencies and private investigators; training requirements for all armed and unarmed guards; a searchable database of agencies and their licensed guards; and clear enforcement mechanisms.

Meanwhile, Community Legal Services of Philadelphia is seeking reform through the courts, arguing that the lifetime ban on guards with criminal records is unconstitutional.

As for Grant, the man who was stabbed at ShopRite over the bouquets of flowers he’d purchased for Mother’s Day 2022, he says that employers should take more responsibility.

For now, he’s taking all precautions.

Last year, he said, “A couple days before Mother’s Day, my mom, my mother-in-law, and my wife all called and texted me, back to back, and said, ‘Do not go get flowers this year! Just give me a card.’”