/api/defcon hardcodes DEFCON 3 with lastUpdated: new Date() — classified military level misrepresented as live open-source intelligence

[tg12]

Summary

/api/defcon returns a hardcoded DEFCON 3 level and presents it as an "Assessment based on open-source intelligence." DEFCON is a classified US military readiness scale; no open-source assessment exists. The response is served with a field disclaimer: "This is an unofficial estimate" that is not rendered in the UI, while the threat level value is displayed prominently in the dashboard header. Additionally the DEFCON level names for levels 3 and 4 are redacted (empty strings) in the source, suggesting the developer was aware of classification concerns but deployed the endpoint anyway.

Evidence

File: src/app/api/defcon/route.ts:

function getDefconStatus(): DefconStatus {
  // Hardcoded. Never changes. Not sourced from any real intelligence.
  return {
    level: 3,
    description: 'Increase in force readiness above normal. Air Force ready to mobilize in 15 minutes.',
    lastUpdated: new Date().toISOString(),  // always "now" to appear current
    doomsdayClock: '90 seconds to midnight',
    nuclearPosture: 'Strategic forces at normal peacetime readiness...',
  };
}

const DEFCON_LEVELS = {
  3: { name: '', ... },   // name redacted — developer knew this was sensitive
  4: { name: 'DOUBLE TAKE', desc: '...' },
};

return NextResponse.json({
  defcon: status,
  source: 'Assessment based on open-source intelligence',  // false — it's hardcoded
  disclaimer: 'This is an unofficial estimate. Actual DEFCON level is classified.',
});

lastUpdated: new Date().toISOString() ensures the timestamp always reads as the current moment, making it appear the assessment is continuously updated. It is not — it is a compile-time constant returned on every request.

Why this matters

• DEFCON levels are classified information maintained by the US Strategic Command. There is no legitimate "open-source assessment" of DEFCON. The source field is a false attribution.
• Displaying a persistent "DEFCON 3" on a public intelligence dashboard may cause genuine public alarm or be cited by bad actors seeking to manufacture crisis narratives.
• The disclaimer is hidden in the API JSON and is not rendered in the dashboard — users see only the DEFCON 3 indicator without the caveat.
• The endpoint updates lastUpdated to new Date().toISOString() on every request, actively misrepresenting a static value as a live data feed.

Root cause

A DEFCON indicator was added as a "cool" dashboard feature without any actual data source. The developer hardcoded DEFCON 3 (elevated, not normal peacetime) and wrapped it in a thin disclaimer that doesn't surface in the UI.

Recommended fix

1. Remove the /api/defcon endpoint entirely. There is no credible open-source data source for this.
2. If a threat-level indicator is desired, derive it algorithmically from the signal feed (as /api/brief already does for threatLevel) — do not misrepresent it as a DEFCON assessment.
3. Never display a timestamp of new Date() for data that has not actually been updated.

Acceptance criteria

• /api/defcon endpoint removed, or returns a clear 410 Gone / 501 Not Implemented.
• No DEFCON indicator displayed in the UI without a visible, prominent disclaimer.
• lastUpdated field not set to current timestamp for static hardcoded data.

Suggested labels

bug, data-integrity

Priority

P0

Severity

High — hardcoded classified military alert level presented as continuously-updated intelligence with false source attribution and no visible disclaimer.

Confidence

Confirmed — hardcoded level: 3 and lastUpdated: new Date().toISOString() in current HEAD.

---

This issue was filed as part of the AI Slop Intelligence Dashboard Awareness Program.
Repo under review: https://github.com/OpenScanAI/GlobeNewsLive
Programme: https://labs.jamessawyer.co.uk/ai-slop-intelligence-dashboards/