It's worth mentioning that there is a
legal definition of fraud[1]. Fraud must be proved by showing that the defendant's actions involved (5) separate elements:
1. A false statement of a material fact is made
2. Knowledge on the part of the defendant that the statement is untrue
3. Intent on the part of the defendant to deceive the alleged victim
4. Justifiable reliance by the alleged victim on the statement
5. Injury to the alleged victim as a result
So if the local government is hacked because they thought the software provided was pen tested and it actually wasn't, congratulations, you've hit fraud bingo.
Important disclaimer: IANAL
[1]: https://legal-dictionary.thefreedictionary.com/Fraud
Edit: Formatting and disclaimer
1. A false statement of a material fact is made
2. Knowledge on the part of the defendant that the statement is untrue
3. Intent on the part of the defendant to deceive the alleged victim
4. Justifiable reliance by the alleged victim on the statement
5. Injury to the alleged victim as a result
So if the local government is hacked because they thought the software provided was pen tested and it actually wasn't, congratulations, you've hit fraud bingo.
Important disclaimer: IANAL
[1]: https://legal-dictionary.thefreedictionary.com/Fraud
Edit: Formatting and disclaimer