LIACOS, J.

The plaintiff, a female student at Pine Manor College (college), was raped on campus by an unidentified assailant who was never apprehended. She commenced this action against the college and its vice president for operations, William P. Person, to recover damages for injuries suffered. The case was tried before a jury in the Superior Court. The jury returned verdicts against the college and Person in the amount of $175,000. Pursuant to G.L.c. 231, § 85K, the trial judge reduced the amount of the judgment against the college to $20,000. The college and Person appeal from the denial of their motions for directed verdicts and for judgments notwithstanding the verdicts. We granted their applications for direct appellate review. We affirm the judgments.

There was evidence of the following facts. Pine Manor College is a four-year college for women located in the Chestnut Hill section of Brookline. In 1977, approximately 400 students attended the school. The campus is surrounded on all sides by a six-foot high chain link fence, except for an area on either side of the main entrance to the campus where the fence stands four feet tall. The college's dormitories are clustered together in three villages. Each village is comprised of a commons building and a number of separate dormitory buildings. The buildings are arranged to form a square. To gain access to a dormitory, a student must enter an enclosed courtyard through either the commons building or one of three exterior gates. Between 5 P.M. and 7 A.M., these gates and the door to the commons building are locked. Students enter their dormitory through locked doors which open directly into the courtyard. Each student had one key which unlocked the doors to her commons building, her dormitory building, and her individual room.

After 8 P.M., all visitors were admitted by a security guard at the main entrance to the campus. The guard would direct them to the appropriate commons building. At the entrance to the commons building, visitors would be stopped by a student on duty and would be registered. The student hostess would be notified and was required to come to the commons building to act as the visitor's escort. No visitors were permitted anywhere on campus unescorted after 1 A.M. on weekends.

At the time of the rape, the college had two guards on duty after midnight. One guard was stationed in an observation post at the main entrance. The second guard was assigned to patrol the campus. He was responsible for making rounds to the villages every fifteen to thirty minutes to check the doors and gates to see that they were locked. The college had no formal system of supervising the guards. Rather, the director of security at the college would make random checks on their work.

Mullins was a first-year student and, as required by the college, she lived on campus. Her dormitory housed thirty women. Under college regulations, male visitors were permitted to stay overnight. Mullins was assigned to a single room at the end of a corridor. Another student resided in a room located adjacent to hers. The doors to these two rooms were at a right angle to each other.

On December 11, 1977, Mullins returned to her dormitory at approximately 3 A.M. with two friends. It was a bitter cold night. They entered the village through one of the exterior gates to the courtyard. It was unlocked. They opened the door to their dormitory and proceeded to their rooms. After changing into her night clothes, Mullins, leaving the door to her room open, went to talk with a friend who resided in the room next door. They talked for a few minutes, apparently near the open door to the friend's room. Mullins returned to her room, locked her door, and went to sleep. Between 4 A.M. and 4:30 A.M., she was awakened by an intruder. He asked her where her car was located, and she responded that she did not have a car. The intruder then threatened her and placed a pillow case over her head. He led her out of the building and across the courtyard. They left the courtyard by proceeding under the chains of one of the exterior gates which was not secured tightly. They walked down a bicycle path toward the refectory, the college's dining hall. After marching about in front of the refectory, they entered the refectory through an unlocked door and spent several minutes inside. They proceeded out of the refectory and marched around in front. They then went back inside, and the assailant raped her. The entire incident lasted sixty to ninety minutes, and they were outside on the campus for at least twenty minutes.

Pine Manor is located in an area with relatively few reports of violent crime. In the years prior to this attack, there had been no incidents of violent crime on the campus. The record discloses, however, that one year before the attack a burglary had occurred in one of the dormitory buildings. Additionally, the evening before the rape, a young man scaled the outer fence around the campus and walked into the commons building of Mullins's village, which was the first building he saw. The door to the building was open. The college is also located a short distance from bus and subway lines which lead directly to Boston.

Additional facts, including the testimony of expert witnesses, will be discussed as they become relevant.

1. Duty to protect against criminal acts. The defendants argue that they owe no duty to protect students against the criminal acts of third parties. They rely on the general proposition that there is no duty to protect others from the criminal or wrongful activities of third persons. See Restatement (Second) of Torts § 314 (1965). Cf. W. Prosser, Torts § 33, at 173-174 (4th ed. 1971) (actor may usually assume others will obey criminal law). But see Restatement (Second) of Torts §§ 302B, 314A 448 (1965). We conclude that this rule has little application to the circumstances of this case.

The duty of due care owed the plaintiff by the defendants in the present case can be grounded on either of two well established principles of law. First, we have said that a duty finds its "source in existing social values and customs." Schofield v. Merrill, 386 Mass. 244, 247 (1982). See Pridgen v. Boston Hous. Auth., 364 Mass. 696, 711 (1974); Mounsey v. Ellard, 363 Mass. 693, 706-708 (1973). We think it can be said with confidence that colleges of ordinary prudence customarily exercise care to protect the well-being of their resident students, including seeking to protect them against the criminal acts of third parties. An expert witness hired by the defendant testified that he had visited eighteen area colleges, and, not surprisingly, all took steps to provide an adequate level of security on their campus. He testified also that standards had been established for determining what precautions should be taken. Thus, the college community itself has recognized its obligation to protect resident students from the criminal acts of third parties. This recognition indicates that the imposition of a duty of care is firmly embedded in a community consensus.

This consensus stems from the nature of the situation. The concentration of young people, especially young women, on a college campus, creates favorable opportunities for criminal behavior. The threat of criminal acts of third parties to resident students is self-evident, and the college is the party which is in the position to take those steps which are necessary to ensure the safety of its students. No student has the ability to design and implement a security system, hire and supervise security guards, provide security at the entrance of dormitories, install proper locks, and establish a system of announcement for authorized visitors. Resident students typically live in a particular room for a mere nine months and, as a consequence, lack the incentive and capacity to take corrective measures. College regulations may also bar the installation of additional locks or chains. Some students may not have been exposed previously to living in a residence hall or in a metropolitan area and may not be fully conscious of the dangers that are present. Thus, the college must take the responsibility on itself if anything is to be done at all. Cf. Young v. Garwacki, 380 Mass. 162, 168 (1980).

Of course, changes in college life, reflected in the general decline of the theory that a college stands in loco parentis to its students, arguably cut against this view. The fact that a college need not police the morals of its resident students, however, does not entitle it to abandon any effort to ensure their physical safety. Parents, students, and the general community still have a reasonable expectation, fostered in part by colleges themselves, that reasonable care will be exercised to protect resident students from foreseeable harm.

The duty of care in this case can be grounded in another theory. It is an established principle that a duty voluntarily assumed must be performed with due care. Black v. New York, N.H., H.R.R., 193 Mass. 448 (1907). See Phillips v. Chicago Hous. Auth., 89 Ill.2d 123 (1982); Cross v. Wells Fargo Alarm Servs., 82 Ill.2d 313 (1980); Pippin v. Chicago Hous. Auth., 78 Ill.2d 204 (1979). Restatement (Second) of Torts § 323 (1965), states: "One who undertakes, gratuitously or for consideration, to render services to another which he should recognize as necessary for the protection of the other's person or things, is subject to liability to the other for physical harm resulting from his failure to exercise reasonable care to perform his undertaking, if (a) his failure to exercise such care increases the risk of such harm, or (b) the harm is suffered because of the other's reliance upon the undertaking."

Colleges generally undertake voluntarily to provide their students with protection from the criminal acts of third parties. The evidence warrants the conclusion that Pine Manor undertook such a duty. It is clear that this undertaking by Pine Manor was not gratuitous. Students are charged, either through their tuition or a dormitory fee, for this service. Adequate security is an indispensable part of the bundle of services which colleges, and Pine Manor, afford their students.

We recognize that the mere fact that Pine Manor had voluntarily undertaken to render a service is not sufficient to impose a duty. It must also be shown that either (a) the failure to exercise due care increased the risk of harm, or (b) the harm is suffered because of the students' reliance on the undertaking. As to the latter, it is quite clear that students and their parents rely on colleges to exercise care to safeguard the well-being of students. When students are considering enrolling in a particular college, they are likely to weigh a number of factors. But a threshold matter is whether the college has undertaken to provide an adequate level of security. Thus, prospective students and their parents who visit a college are certain to note the presence of a fence around the campus, the existence of security guards, and any other visible steps taken to ensure the safety of students. They may inquire as to what other measures the college has taken. If the college's response is unsatisfactory, students may choose to enroll elsewhere. The record indicates that Mullins visited several colleges, including Pine Manor, with her father during the summer before her senior year of high school. Thus, the jury could have found that students and their parents rely on the willingness of colleges such as Pine Manor to exercise due care to protect them from foreseeable harm.

These two principles of law provide a sufficient basis for the imposition of a duty on colleges to protect their resident students against the criminal acts of third parties. Colleges must, therefore, act "to use reasonable care to prevent injury" to their students "by third persons whether their acts were accidental, negligent, or intentional." Carey v. New Yorker of Worcester, Inc., 355 Mass. 450, 452 (1969).

We reject the argument advanced by the college and Person that the criminal attack here was not foreseeable. This contention is untenable in light of Person's testimony which admitted that he had foreseen the risk that a student at Pine Manor could be attacked and raped on campus. Indeed, the precautions which Pine Manor and other colleges take to protect their students against criminal acts of third parties would make little sense unless criminal acts were foreseeable. The director of student affairs testified that she warned students during freshman orientation of the dangers inherent in being housed at a women's college near a metropolitan area only a short distance from bus and train lines which lead directly to Boston. The risk of such a criminal act was not only foreseeable but was actually foreseen.

The college and Person, however, urge us to adopt an arbitrary limitation on liability by requiring that a student must introduce evidence of prior criminal acts on the campus. They rely on cases from other jurisdictions which hold that an owner or occupier of land is under no duty to protect persons lawfully on the premises against the criminal acts of third persons unless prior criminal acts occurred on the premises. See e.g., Riley v. Marcus, 125 Cal.App.3d 103, 109 (1981); Scott v. Watson, 278 Md. 160, 169 (1976); Gulf Reston, Inc. v. Rogers, 215 Va. 155, 157-159 (1974). We choose not to follow those cases, at least in the circumstances before us. Those cases consider the general duty of an owner or occupier of land to persons lawfully on the premises. That duty implicates a wide range of interests that are not present here. The instant case concerns only the distinctive relationship between colleges and their students. But see Relyea v. State, 385 So.2d 1378 (Fla. Dist. Ct. App. 1980). Moreover, the standard of foreseeability turns on an examination of all the circumstances. Mounsey v. Ellard, 363 Mass. 693, 708-709 (1973). Prior criminal acts are simply one factor among others that establish the foreseeability of the act of the third party. Samson v. Saginaw Professional Bldg., Inc., 393 Mich. 393, 406-407 (1975).

2. Sufficiency of the evidence. We construe the evidence most favorably to Mullins to determine "whether `anywhere in the evidence, from whatever source derived, any combination of circumstances could be found from which a reasonable inference could be drawn in favor of the plaintiff.'" Poirier v. Plymouth, 374 Mass. 206, 212 (1978), quoting Raunela v. Hertz Corp., 361 Mass. 341, 343 (1972). "We are mindful that the inferences must be based on `probabilities rather than possibilities' and not the result of `mere speculation and conjecture.' Alholm v. Wareham, 371 Mass. 621, 627 (1976)." International Fidelity Ins. Co. v. Wilson, 387 Mass. 841, 848 (1983).

a. Negligence. Usually "the question of negligence is one of fact for the jury. Only when no rational view of the evidence warrants a finding that the defendant was negligent may the issue be taken from the jury. Luz v. Stop Shop, Inc. of Peabody, 348 Mass. 198, 203-204 [1964]. Beaver v. Costin, 352 Mass. 624, 626 [1967]." Zezuski v. Jenny Mfg. Co., 363 Mass. 324, 327 (1973). There was sufficient evidence from which the jury could have concluded that the defendants were negligent.

Person admitted that he designed and supervised the installation of the security system. He acknowledged that he was responsible for establishing the patrol pattern and the network of locks. The jury could have found the following deficiencies in the college's security system. An observation post near the main entrance is situated at such a distance from the fence that an intruder could climb over the fence without being detected by the guard on duty. The exterior gates leading into the courtyards were not difficult to scale or to open. The walls surrounding the courtyards were too low to be adequately protective. The college used a single key system whereby the same key would open the door to the commons building, the door to the dormitory, and the door to the individual room. Only two security guards were on duty at any time. No system was utilized to ensure that the guards were performing their patrols around the campus. The locks on the doors to the dormitory and the individual rooms were easy to pick, and neither deadbolts nor chains were used. The jury also could have credited the opinion of the plaintiff's expert that the security provided by Pine Manor was inadequate to protect a student in the position of the plaintiff. Additionally, there was evidence that after the evening of the attack, the college hired two additional guards to patrol the villages from 11:30 P.M. to 7:30 A.M. and installed chains on the interior side of the doors to individual rooms. There was also ample evidence that the guards failed to perform their duties both prior to the attack and on the evening of the attack. There was evidence that the locks to the individual rooms could be opened with a credit card. There was also evidence that the door to Mullins's dormitory lacked a knife guard which the defendants' expert witness indicated should have been present.

b. Causation. The question of causation is generally one of fact for the jury. Zezuski v. Jenny Mfg. Co., supra at 327. A plaintiff need only show "that there was greater likelihood or probability that the harm complained of was due to causes for which the defendant was responsible than from any other cause. McLaughlin v. Berstein, 356 Mass. 219, 226 (1969). An expert's opinion based on facts in evidence is sufficient proof of causation. Black v. Boston Consol. Gas. Co., 325 Mass. 505 (1950). The plaintiffs are not required to eliminate entirely all possibility that the defendant's conduct was not a cause. It is enough that they introduce evidence from which reasonable men may conclude that it is more probable that the event was caused by the defendant than that it was not. Restatement (Second) of Torts § 433B, Comment b (1965)." Carey v. General Motors Corp., 377 Mass. 736, 740 (1979). Miles v. Tabor, 387 Mass. 783, 787 (1982). Zezuski v. Jenny Mfg. Co., supra at 328-329.

The jury could have found that the negligence of the defendants caused the plaintiff's injury. First, the chain of events resulting from the defendants' negligence clearly extended to permitting the assailant to reach the point where he stood outside Mullins's locked door. An expert witness testified that the deficiencies of the college's security system were a substantial cause of the attack. He testified that an assailant could gain access easily to the campus as a result of the low fence near the front entrance, the placement of the observation post, and the absence of adequate patrols around the perimeter. Once an intruder was on the campus, the courtyard was readily accessible. The expert testified that the exterior gates were like stepladders and could be scaled without any difficulty. A photograph of a gate introduced in evidence confirmed this testimony. Moreover, Mullins testified that she and her friends entered the courtyard through an open gate. She also testified that she and the assailant later left the courtyard through a gate that was not properly secured. The design of those gates, as well as the fact that they were not tightly secured, was properly attributable to the negligence of the defendants.

The jury could have traced the chain of causation one step further. The expert testified that the lock to the dormitory was inadequate and could be picked easily. Moreover, a photograph of the doors indicated that the college had not installed a knife guard. The defendants' expert witness testified that a knife guard would have been an important element of an adequate system of security. The jury could have concluded that a proper locking system on those doors would have prevented the assailant from gaining entry to the dormitory.

We think also that the jury were entitled to discount the possibility that the assailant was a person lawfully on the premises. The only fact in the record which suggests this possibility is that males were permitted to stay overnight in Mullins's dormitory on weekends. There is no evidence in the record, however, that any male visitors in fact stayed overnight on the night of the rape. It is therefore mere conjecture to suggest that the assailant was lawfully on the premises, and Mullins is not required to eliminate every possibility. Carey v. General Motors Corp., supra at 740. Furthermore, the dormitory housed only thirty women. Male guests were required to be registered and escorted by a Pine Manor student. They were not permitted to roam freely. The jury could have concluded that it was more probable than not that the assailant was a trespasser.

The jury also could have found that the defendants' negligence permitted the assailant to enter Mullins's room. An expert witness testified that the lock on the door was inadequate. There was ample evidence indicating that the lock on Mullins's door could be picked with a credit card. An expert witness also pointed to the absence of either a chain or a deadbolt as a deficiency in the locking system. He also testified that the presence of a chain could have prevented the attack. Testimony of the defendants' expert witness confirmed this view. The jury, therefore, could have concluded that the attack would not have successfully occurred had the college installed an adequate locking system on the doors to Mullins's room.

The few minutes Mullins spent talking with a friend did not break the chain of causation. Mullins testified that she went next door for a few minutes. The door to her friend's room was open as they talked. A photograph introduced in evidence reveals that Mullins's room formed the end of a narrow dead end corridor. The view out of her room is directly down the length of the corridor to a lounge room. Her friend's door was located a few feet down the hall toward the lounge room. Her door was at a right angle with Mullins's door. Therefore, the assailant could not have entered Mullins's room without passing directly in front of Mullins and her friend as they were talking. Given these facts, the jury could have concluded that the assailant would have been detected if he had attempted to slip into Mullins's room during the few minutes that she spent next door.

Furthermore, Mullins lived in a single room. The opportunities for concealment in a single room of this type are exceedingly limited. The assailant also did not awaken Mullins until well over an hour after she went to sleep. These facts support the view that the assailant entered the room after Mullins had returned from her friend's room. In light of the evidence, it is entirely speculative to say that the assailant might have entered the room during the few minutes when Mullins went next door.

The jury also could have found that it was more likely than not that the assailant and Mullins would have been discovered had the defendants established an adequate system for supervising the guards and had employed three or four guards during the evening hours. The record is replete with evidence demonstrating that the guards did not carry out their duties. The guards were responsible for seeing that the gates to the village courtyards and the doors to the various buildings on campus were locked. One guard was assigned to patrol the campus every fifteen to thirty minutes and was required to check the gates and doors on each patrol. One of the guards on duty the night of the attack testified that if the gates to the courtyard were open, that fact would indicate that the guard had not performed those functions assigned to him. There was evidence that the gates were not locked and secured. Mullins testified that one gate to the courtyard was open at 3 A.M. when she returned to the village. She also testified that she and the assailant proceeded underneath the chains of another gate which was not adequately secured. Further, the door to the refectory was unlocked and, the evening before, the door to the commons room of Mullins's village was wide open. These facts warrant the conclusion that the guards had not made their rounds.

Second, the jury could have concluded that reasonable persons in the position of the defendants would have hired two additional guards. These additional guards would have permitted three guards to be patrolling the campus at any one time. A guard would have been beginning a round of the campus every five to ten minutes. Mullins testified that she and the assailant spent at least twenty minutes outside. The jury could have inferred that the actual period was longer. Mullins also testified that the assailant marched her back and forth in front of the refectory for a considerable period of time. From these facts, the jury could have concluded that it was more probable than not that, had the college deployed three guards, at least one of those guards would have seen Mullins, who had a pillow case over her head, and the assailant at some point during the march out of the dormitory, across the courtyard, down the bicycle path, and back and forth in front of the refectory.

The jury also could have considered the fact that the refectory should have been locked. Had it been locked, the assailant would have been faced with a choice. Given the bitter cold temperature, the rape most likely would not have been performed outdoors. The assailant most likely would have been compelled to either abandon his plan or begin a new search for some other sheltered location. The latter alternative would have required the assailant to march Mullins around the campus for a considerable period of time. The likelihood of discovery would have been increased, especially if three guards had been patrolling the campus. We conclude that the evidence warranted the conclusion that the defendants' negligence was a substantial cause of the attack.

c. Proximate causation. The college and Person next argue that the judge should have ruled, as matter of law, that the intervening criminal act of an unknown third person was a superseding cause which severed the chain of proximate causation. Our holding that the defendants had foreseen the risk of criminal attack largely disposes of the issue. The act of a third party does not excuse the first wrongdoer if such act was, or should have been, foreseen. See Gidwani v. Wasserman, 373 Mass. 162, 166 (1977); Carey v. New Yorker of Worcester, Inc., 355 Mass. 450, 452-453 (1969); Lane v. Atlantic Works, 111 Mass. 136, 139-140 (1872); Restatement (Second) of Torts § 448 (1965). There was no error in submitting the case to the jury.

3. Liability of an officer of a charitable corporation in tort. Person contends that he is entitled to the protection of the charitable immunity doctrine and that he cannot be held liable for mere negligence in the performance of a discretionary function. These questions were not raised below and, if we followed our usual practice, we would not consider them on appeal. However, because the questions presented are of some public importance and the result we reach is not changed by our consideration of them, we choose to state our views briefly. Royal Indem. Co. v. Blakely, 372 Mass. 86, 88 (1977).

The common law doctrine of charitable immunity provides that charitable institutions are immune from liability for their torts. McDonald v. Massachusetts Gen. Hosp., 120 Mass. 432, 436 (1876). The general rule, however, is that an agent is not entitled to the protection of his principal's immunity even if the agent is acting on behalf of his principal. Restatement (Second) of Agency § 347 (1) (1958). In 1971, the Legislature abolished entirely the defense of charitable immunity from tort liability "if the tort was committed in the course of activities primarily commercial in character even though carried on to obtain revenue to be used for charitable purposes." G.L.c. 231, § 85K, inserted by St. 1971, c. 785, § 1. "[I]f the tort was committed in the course of any activity carried on to accomplish directly the charitable purposes" of a charitable institution, liability may not exceed $20,000. Id. This reflects a legislative determination to confine narrowly the doctrine of charitable immunity. We decline to ignore the wishes of the Legislature and expand the doctrine beyond its original boundaries.

We also reject the contention that an officer of a charitable institution may not be held liable for the negligent performance of a discretionary function without evidence of bad faith. Person relies primarily on our decision in Whitney v. Worcester, 373 Mass. 208, 217-218, 220-221 (1977), where we said that governmental entities and officials should be immune from liability when the conduct causing the injury involves the exercise of judgment and discretion. Our decision there rested on overriding considerations of public policy affecting the very quality and efficiency of government itself. Id. at 218. These considerations are not present in the instant case. Cf. LaClair v. Silberline Mfg. Co., 379 Mass. 21, 28-29 (1979) (corporate officer is not immune from liability for acts and omissions which occur while performing corporate business).

Judgments affirmed.