OPINION

HOWE, Judge:

¶ 1 This appeal is based on wrongful death claims by a sexual assault victim and the families of several murder victims (collectively, "Families") of the "Baseline Killer" Mark Goudeau against the City of Phoenix and Phoenix Police Laboratory Services Bureau ("Bureau") employees Allison Sedowski and Roger Schneider (collectively, "City"). The Families argued that the City breached a duty of care owed the Families to "conduct reasonable investigations in criminal matters to avoid delayed apprehension and continued victimization," which amounted to gross negligence in violation of A.R.S. § 12-820.02(A)(1). The City moved for summary judgment. In granting the motion, the trial court concluded that the City did not owe the Families a duty of care and that their negligence claims therefore failed. The Families appeal from that judgment.

¶ 2 We hold that the trial court correctly granted summary judgment against the Families because neither a special relationship, A.R.S. § 12-820.02(A)(1), nor other public policy imposed a duty upon the City necessary to maintain the Families' negligence claims.

FACTS AND PROCEDURAL HISTORY

¶ 3 In September 2005, Phoenix Police responded to a report that an unknown man had sexually assaulted A.L. and her sister in south Phoenix. After giving her account of the assault to officers, A.L. had a sexual assault examination. During the examination, the police collected swabs from A.L.'s body, including from her left breast, and sent them to the Bureau at the end of that month for DNA analysis. At about this same time, Phoenix Police responded to two other sexual assault reports in south Phoenix with accounts similar to A.L.'s, leading police to believe they were dealing with a serial rapist.

¶ 4 Between September and December, the Bureau performed DNA analysis on the swabs collected from A.L. Sedowski, a forensic scientist at the Bureau, analyzed the swabs for nucleated cellular material that could contain DNA from which analysts could extract a genetic profile. Sedowski was unaware during this analysis that the evidence was part of an ongoing investigation regarding a serial rapist. Sedowski forwarded those swabs that had a higher rating of nucleated cellular material — which did not include the left breast swabs — because those with the higher rating possessed the "strongest potential for developing a DNA profile." But the results of further DNA testing were inconclusive.

¶ 5 Accordingly, Schneider, a Bureau supervisor, decided to wait for the police to compile a suspect list so that the Bureau could send the swabs, including the left breast swabs that Sedowski did not forward, to the Arizona Department of Public Safety ("DPS") for Y-STR testing. A Y-STR test, which the Bureau was not equipped to perform at the time, generates only a partial genetic profile from male-DNA, and therefore requires a suspect list to compare the results against. By the time Schneider made this decision, the Bureau knew only that the evidence "possibly could be a serial rape case."

¶ 6 Beginning December 2005 and continuing into 2006, Phoenix Police investigated the murders of seven women. In May 2006, police responded to a report of sexual assault of a woman who survived an attack and gave police a description of her assailant. Based on her description, the police linked the murders and sexual assaults together and, approximately three months later, compiled a suspect list. The police used this suspect list to request additional DNA testing from DPS. DPS testing ultimately linked the DNA on the left breast swabs to Goudeau. The DPS analyst reported these results to police on September 6, 2006, and police arrested Goudeau that same day.

¶ 7 The surviving victim of Goudeau's sexual assault and the families of victims he murdered between December 2005 and May 2006 separately sued the City, but the trial court later consolidated their claims. Collectively, the Families alleged wrongful death claims against the City for gross negligence in their investigation and failing to identify Goudeau during their initial DNA testing. They alleged that the City's failure allowed Goudeau to remain at large and, because he was not in custody, commit the offenses. The City moved for summary judgment, arguing, among other reasons, that it did not owe the Families any duty of care and had qualified immunity from liability under A.R.S. § 12-820.02(A)(1), which protects public employees from tort liability for failing to arrest unless they engage in grossly negligent behavior. The trial court granted the City's motion, concluding that the City owed no duty to the Families on which a gross negligence claim could be based because both the Families and the suspect were unknown to the City at the time and that extending a duty to it would "impose insurer-like liability on a law enforcement agency." After unsuccessfully moving for a new trial, the Families timely appealed.

DISCUSSION

¶ 8 The Families argue that the trial court erred in granting summary judgment against them because the City owed them "a duty of non-grossly negligent care" in identifying and arresting Goudeau. We review de novo the trial court's grant of summary judgment. City of Scottsdale v. State, 237 Ariz. 467, 469 ¶ 9, 352 P.3d 936, 938 (App. 2015). Whether a duty exists is a purely legal issue. Gipson v. Kasey, 214 Ariz. 141, 143 ¶ 9, 150 P.3d 228, 230 (2007). Additionally, we review the interpretation of a statute de novo. Hoffman v. Chandler, 231 Ariz. 362, 364 ¶ 8, 295 P.3d 939, 941 (2013). Our primary goal in interpreting a statute is to determine and give effect to the legislature's intent. Estate of Jung, 210 Ariz. 202, 204 ¶ 12, 109 P.3d 97, 99 (App. 2005). We narrowly construe immunity provisions applicable to government entities, Glazer v. State, 237 Ariz. 160, 163 ¶ 12, 347 P.3d 1141, 1144 (2015), but may not construe an immunity provision so narrowly that the legislature's grant of immunity is abrogated, Greenwood v. State, 217 Ariz. 438, 443 ¶ 16, 175 P.3d 687, 692 (App. 2008). Here, because the City did not endeavor to provide the Families with specific protection against Goudeau, the City had no special relationship with the Families and owed them no duty to identify and arrest Goudeau. Further, public policy did not impose a duty on the City.

¶ 9 Public entities and employees are subject to tort liability for their negligence. Greenwood, 217 Ariz. at 442 ¶ 14, 175 P.3d at 691. Arizona's legislature, however, has created a qualified immunity from liability for public employees under certain circumstances. See A.R.S. §§ 12-820-823; Glazer, 237 Ariz. at 163 ¶ 11, 347 P.3d at 1144. In enacting the immunity statutes, the legislature "recognized that sovereign immunity is sometimes necessary given the breadth of the government's exercise of power." Walls v. Ariz. Dep't of Public Safety, 170 Ariz. 591, 594, 826 P.2d 1217, 1220 (App. 1991). The immunity provisions' expressly stated "legislative purpose and intent" stated that the government does "not have a duty to do everything that might be done." 1984 Ariz. Sess. Laws, Ch. 285, § 1 (2nd Reg. Sess.). As relevant here, A.R.S. § 12-820.02(A)(1) provides that unless a public employee acting within the scope of their employment "intended to cause injury or was grossly negligent, neither a public entity nor a public employee is liable for ... [t]he failure to make an arrest or the failure to retain an arrested person in custody."

¶ 10 The qualified immunity that the legislature granted in A.R.S. § 12-820.02(A)(1) applies to a plaintiff's claim of failure to arrest. See Walls, 170 Ariz. at 594, 826 P.2d at 1220. Even if a plaintiff's claim does not specifically state that it is for a "failure to arrest" but is nonetheless "in essence" and "at its core," an allegation that the defendants failed to arrest a perpetrator, the immunity statute applies. Greenwood, 217 Ariz. at 443, 444 ¶¶ 17, 22, 175 P.3d at 692, 693 (applying A.R.S. § 12-820.02(A)(1) when plaintiff alleged that but for faulty record keeping, law enforcement would have arrested a perpetrator before he caused more harm). Because the Families' allegations that the City did not test all the swabs during initial DNA testing or take other investigatory steps to identify Goudeau sooner are at their core allegations that the City failed to arrest him before September 2006, A.R.S. § 12-820.02(A)(1)'s immunity applies. To overcome this qualified immunity and hold the City liable, then, the Families must prove that the City was grossly negligent in failing to arrest Goudeau.

¶ 11 To establish a claim of gross negligence, the plaintiff must prove, among other things, the existence of a duty of care. Tostado v. City of Lake Havasu, 220 Ariz. 195, 201 ¶ 26, 204 P.3d 1044, 1050 (App. 2008). A duty is an obligation, recognized by the law, requiring a person to conform to a particular standard of conduct to protect others from unreasonable risks of harm. Gipson, 214 Ariz. at 143 ¶ 10, 150 P.3d at 230. Whether a duty exists is a threshold matter of law for the courts to decide. Id. at ¶¶ 9, 11. As relevant to the Families' arguments here, a duty of care may arise from the existence of a special relationship or may be created by public policy, including statute or common law. See Wickham v. Hopkins, 226 Ariz. 468, 473 ¶ 24, 250 P.3d 245, 250 (App. 2011). Absent some duty, an action for negligence fails. Gipson, 214 Ariz. at 143 ¶ 11, 150 P.3d at 230. Because a duty of care arose neither from the existence of a special relationship nor from public policy, the Families' claims fail.

¶ 12 A defendant's conduct may create a special relationship that gives rise to a duty. Id. at 145 ¶ 18, 150 P.3d 228, 232. In Arizona, if police endeavor to provide specific protection to a particular person, they generally only have "a duty to act as would a reasonably careful and prudent police department in the same circumstances." Austin v. City of Scottsdale, 140 Ariz. 579, 581-82, 684 P.2d 151, 153-54 (1984). The duty owed is not to "protect each citizen within [its] geographical boundaries from all harms"; merely establishing a police department does not make a city "a general insurer of safety or liable for absolutely all harms to its citizens." Id. at 582 n. 2, 684 P.2d at 154 n. 2; see also Wertheim v. Pima County, 211 Ariz. 422, 426 ¶ 17, 122 P.3d 1, 5 (App. 2005) (rejecting the argument that a police agency, "by its very existence," owes a duty to all persons). Arizona courts have found that police conduct has created a special relationship giving rise to a duty only in specific circumstances, for example when police take a 911 call about a potential threat and tell the caller that they will take action on that information. See Austin, 140 Ariz. at 579-80, 581-82, 684 P.2d at 151-52, 153-54; Hutcherson v. City of Phoenix, 192 Ariz. 51, 52-53 ¶¶ 1-7, 961 P.2d 449, 450-51 (1998).

¶ 13 No special relationship giving rise to a duty of care existed here. First, much like a police agency's mere existence does not create a duty to guarantee the safety of individual members of the public, the Bureau's mere existence does not create a duty to conduct all DNA tests on all evidence or subject the City to liability if such testing is not done immediately. Further, the Bureau's existence certainly does not create a duty to protect all citizens within Phoenix's boundaries against all harms from perpetrators that may ultimately be identified through evidence analysis. To hold so would make the City "general insurers" for the safety of all citizens. See Vasquez v. State, 220 Ariz. 304, 313 ¶ 31, 206 P.3d 753, 762 (App. 2008) (agreeing that if the law imposed a duty by police undertaking, every unsolved crime could theoretically give rise to causes of action for negligent investigation by victims or their families).

¶ 14 Second, the City's undertaking an investigation into A.L.'s sexual assault by collecting and testing swabs before knowing Goudeau's identity did not constitute endeavoring to provide a particular protection from his harm because the City did not have sufficient information about that harm. Although the Bureau ultimately learned that the swabs from A.L.'s sexual assault examination might relate to a serial rapist, the Families did not establish that the Bureau had reason to know if, when, how, upon whom, or by whom a subsequent offense might occur. This case is thus unlike Austin. The Arizona Supreme Court found there that a city owed a duty to the murder victim and his family because the police knew the victim's identity and location and had been warned that his life was in danger during a specific window of time. 140 Ariz. at 582, 684 P.2d at 154. Because the City did not have this type of information — information about a specific current threat against the victims in this case — the City had no special relationship with them that would have created a duty owed to them.

¶ 15 The Families counter that a special relationship nevertheless existed because, had the City "tested and cross-checked" the DNA evidence against criminal databases, the additional DNA test results would have identified Goudeau as the perpetrator and he would therefore not have been an unknown suspect. But this argument assumes that the City owed a duty to take such actions, which it did not here. Merely investigating a crime, without any specific endeavor to provide specific protection that would otherwise create a special relationship, does not create a duty to a victim's family. Guerra v. State, 237 Ariz. 183, 187 ¶ 19, 348 P.3d 423, 427 (2015). Thus, the trial court did not err in granting summary judgment against the Families because a duty did not arise from the existence of a special relationship.

¶ 16 The Families also argue that regardless whether a special relationship existed, public policy imposed a duty upon the City. Specifically, the Families argue that the legislature imposed a "duty of non-grossly negligent care" upon police departments in failing to make an arrest by enacting the immunity statute itself. The Families further argue that the city of Phoenix imposed a duty by enacting Phoenix City Code § 2-119, which mandates that the director of the Phoenix Police Department shall be responsible for investigating crimes and "shall arrest... all persons committing or attempting to commit an offense...." Because the Families assert these arguments for the first time on appeal, we need not consider them. See Rigoli v. 44 Monroe Mktg., LLC, 236 Ariz. 112, 120 ¶ 28, 336 P.3d 745, 753 (App. 2014) ("Issue and arguments raised for the first time on appeal are untimely and usually deemed waived.").

¶ 17 Waiver aside, however, the Families' arguments that public policy imposed a duty necessarily fail. First, the immunity statute does not affirmatively impose a duty; the statute immunizes public entities from tort liability to which they are generally subject. See Walls, 170 Ariz. at 594, 826 P.2d at 1220 (recognizing the legislature's intent for the government to enjoy sovereign immunity given its broad exercise of power, including immunity for failing to make an arrest). The Families' arguments therefore misapply the law and flip the analysis on its head by looking at the statute as a source of liability rather than a source of immunity for failing to make an arrest. The statute's express terms and legislative purpose and the decisions interpreting the statute negate the Families' argument that the immunity statute creates a duty. See A.R.S. § 12-820.02(A)(1) ("... neither a public entity nor a public employee is liable for ... the failure to make an arrest ..."); 1984 Ariz. Sess. Laws, Ch. 285, § 1 (2nd Reg. Sess.) ("... therefore the government should not have the duty to do everything that might be done..."); Walls, 170 Ariz. at 594, 826 P.2d at 1220 (stating that the immunity statute "creates a qualified immunity for public employees and entities for certain actions); Clouse ex rel. Clouse v. State, 199 Ariz. 196, 204 ¶ 26, 16 P.3d 757, 764 (2001) (finding that the legislature acted within its constitutional limits in enacting the immunity statute, which "explicitly confers qualified ... immunity" and in deciding that it "furthers a valid public policy").

¶ 18 Second, the sections of the Phoenix City Code that the Families cite merely articulate the general responsibilities of the police department's director and do not impose a duty upon all members of the police department, including those of the Bureau. See Phoenix, Ariz., Code § 2-119 (a), (b) (2016). Thus, public policy did not create a duty. Accordingly, because a duty of care did not arise from the existence of a special relationship between the parties nor was imposed by public policy through either statute or common law, summary judgment was appropriate.

CONCLUSION

¶ 19 For the foregoing reasons, we affirm.