BLACKSBURG, Va.—Virginia Polytechnic Institute and State University officials do not have ironclad immunity for how they responded to the shootings that claimed the lives of 32 students and faculty last week, but proving them liable would be difficult, plaintiffs attorneys agree.

Even gunman Cho Seung-Hui's troubled past likely did not create a legal duty of care that plaintiffs would have to show that the school owed the victims, the attorneys said.

"Anyone who brings any kind of wrongful death lawsuit against Virginia Tech would have an uphill battle," said plaintiffs attorney Thomas Albro, a partner at Tremblay & Smith L.L.P. in Charlottesville, Va.

Critics of school officials say their two-hour delay in notifying the campus about the first two murders and their decision to not lock down or evacuate the campus left the second group of victims needlessly exposed to danger.

Within 15 minutes of the first two murders, police had pulled over a man on a nearby highway for questioning in the case. More than two hours later, as the man--whom police described as "a person of interest"--was still being questioned off campus, university officials first notified all faculty and staff by e-mail of the homicides and asked to be notified of any suspicious activity.

About 20 minutes later, as the person of interest was still being questioned, police received reports of more gunfire at the school. At the second shooting scene, 30 students and faculty were killed before the gunman--who committed the first two murders--killed himself.

Virginia Gov. Timothy M. Kaine has established an independent panel to review the school officials' response to the crisis. Reviews of the state's response to any disaster are routine, a spokesman for the governor noted.

Many, though not all, state employees have immunity for their actions, but a court would have to confirm immunity through a four-prong test that examines--among other things--the employee's discretionary authority, Mr. Albro noted.

School officials have "a lot of discretion," so plaintiffs would have to show they were grossly negligent, Mr. Albro said. That would mean the defendants would have had to exercise "very little, if any, care," he said.

Plaintiffs' attorney Robert T. Hall said proving gross negligence means showing the defendants "knew harm is likely to occur" because of their actions.

"That's a very difficult burden to prove," said Mr. Hall of Hall, Sickels, Frei, Kattenburg & Mims P.C. in Reston, Va. Mr. Hall is president of the Minneapolis-based International Academy of Trial Lawyers and former president of the Virginia Trial Lawyers Assn.

Both Messrs. Albro and Hall noted that even if the state's investigation concludes that school officials should have notified the campus sooner about the first two murders and taken other security measures until police had secured the campus, the officials' actions have to be weighed against the information they had at the time.

If, in hindsight, they responded in a way that later creates questions, "that doesn't create liability" necessarily, Mr. Hall said.

And despite the gunman's troubled past--including a judge's 2005 ruling that he was mentally ill and a danger to himself--"it would be very difficult to establish that anyone had a duty" to be aware of the student's behavior and propensity for violence, Mr. Hall said.

"To be angry at the world, being angry at the rich, being angry at the powerful doesn't cut it" for establishing a duty of care, he said.

Peter Lake, a professor of insurance law at Stetson University Law School in DeLand, Fla., agreed. He also noted that case law on the duty of care owed by higher education institutions is not well developed.

Mr. Lake also noted that the mental health counselors who evaluated the gunman following the judge's 2005 order that he receive outpatient care had no legal obligation to notify Virginia Tech even if he posed an imminent threat. Virginia and Texas are the only two states that do not require such notifications, he said.