#822 1268 · Republic of Venice · Public administration / political institutions
Venice picked its head of state with a protocol modern cryptographers still study for defeating collusion
the problem
A pure election let rich factions buy votes, and a pure lottery ignored competence entirely — every simple selection method had an obvious failure mode
background
By the 13th century, Venice needed a reliable way to select its Doge, the republic's head of state, from among its aristocratic families, in a political environment where rival factions had the wealth and motive to buy or coerce a favorable outcome. A straightforward election among the aristocracy invited vote-buying and domination by whichever faction had the most money or influence; a straightforward lottery avoided that risk but ignored competence and legitimacy entirely, since a purely random draw could hand power to someone with no support or ability.
Any selection method that used a fixed, predictable path from candidacy to office also created a specific target: factions with enough resources could identify in advance exactly who would hold decisive voting power at each stage and focus their bribery or coercion precisely there.
what everyone would do
The available selection methods were a straightforward election, which let wealthy factions identify and buy or coerce known voters, or a straightforward lottery, which avoided manipulation entirely but ignored competence and legitimacy since the outcome was pure chance. Every simple method available fell into one of those two failure modes.
what they saw
Venice saw that the actual vulnerability in an election wasn't the voting itself, it was the predictability of who would hold decisive power at each stage — a faction that could identify in advance exactly which individuals would vote could bribe or coerce precisely those people. Interleaving unpredictable random narrowing with deliberative approval at each stage meant no one could know far enough ahead who would need to be corrupted, while committee approval still stayed in the loop to filter for genuine legitimacy rather than leaving everything to chance.
the move
Starting in 1268 and continuing until the end of the Republic in 1797, Venice selected its Doge through ten alternating rounds of random lottery and committee approval voting: thirty Great Council members were chosen by lot, reduced by lot to nine, who nominated forty candidates each requiring individual approval votes, reduced by lot to twelve, who nominated twenty-five, reduced by lot to nine, who nominated forty-five, reduced by lot to eleven, who elected the final forty-one electors, sequestered until they chose the Doge by a supermajority of at least twenty-five votes.
why it works
Alternating a random lottery draw with a committee approval vote across ten sequential stages means each stage's composition depends on an unpredictable draw from the prior one, so no faction can determine far enough in advance which specific individuals will hold decisive power at any future stage. Without a known, fixed target, the cost of trying to corrupt the process rises sharply, since a faction would have to try to influence everyone who might conceivably be selected rather than a small, identifiable set of voters. Because approval voting is still interleaved at multiple stages rather than pure lottery throughout, candidates still have to build broad support among their peers to advance, keeping the process a filter for legitimacy and competence, and the final stage's supermajority requirement (twenty-five of forty-one votes) ensures the eventual Doge commands broad backing even after surviving nine rounds specifically designed to defeat manipulation.
the payoff
Because no faction could know far enough in advance which specific individuals would hold decisive power at any given stage, the protocol made concentrated bribery or coercion of the election impractical, while the repeated committee-approval steps still filtered for candidates with broad support rather than leaving the outcome purely to chance.
where it breaks
The method requires enough sequential stages and a large enough initial pool that randomization actually creates meaningful uncertainty — too few participants or too few stages leaves too small a pool for a well-resourced faction to simply try to influence everyone in it. It also imposes real costs in complexity and time, since ten alternating rounds of lottery and voting is far slower than a single election, a cost only worth paying when the stakes are high enough to justify defending against sustained, well-funded manipulation. And it depends entirely on the lottery mechanism itself being genuinely unpredictable and tamper-proof — if the drawing of lots could be rigged or predicted, the whole unpredictability advantage collapses back into a fixed, corruptible target.
what came after
The Venetian election protocol has drawn sustained modern academic interest well outside history departments: computer scientists Miranda Mowbray and Dieter Gollmann formally analyzed it as a leader-election protocol at the 2007 IEEE Computer Security Foundations Symposium, and security researcher Bruce Schneier has separately written about its collusion-resistance properties as a genuine design worth studying for modern secure-election and leader-selection protocols, roughly seven centuries after Venice adopted it for entirely different reasons.
references
- [1]Electing the Doge of Venice: Analysis of a 13th Century ProtocolHP Labs Technical Report / IEEE Computer Security Foundations Symposium, 2007rangevoting.org
- [2]Security Analysis of a Thirteenth-Century Venetian Election ProtocolSchneier on Security, 2023schneier.com