“Official assurance of resilience conflicts with the underlying context of active infrastructure attacks, creating a mixed tone.”