Electing the Doge of Venice Analysis of a th Century - PDF document

theydislikewillbeelected.Ifontheotherhandeachcan-didateisconsideredbythecollegeinturn,Linespointsoutthattacticalvotingmaybenecessary.In1268theproto-colspeciedthateachcandidatewasconsideredinturn,butconcurrentvotingwasintroducedatalaterdate—itisnotclearexactlywhen.Infact,thereisacase(describedin[15]p.300)inwhichtacticalvotingallegedlydeterminedtheoutcomeofoneelectionforDoge.In1423FrancescoFoscari,anunderdogcandidate,received17approvalvotesoutof41intheninthballotbythenalcollegeand26approvalvotesinthetenthballot,thuswinningtheelection.Itwasclaimedthathissupportershadengineeredthiswinbyvotinginearlierbal-lotsforacandidatethatno-onewanted,thusenticingotherstovoteforFoscari,andthensuddenlyswitchingtheirvotes.Presumablyin1423concurrentvotinghadnotyetbeenin-troduced.CogginsandPerali[4]lookattheminimumapprovalnumbersusedintheprotocol.Theypointouttheremark-ablefactthat25isexactlytheminimumapprovalnumberthatshouldbechosenforthenalroundinordertomaketheprotocolsatisfyCablinandNalebuff's64%majorityrule[3].Thishastheeffectthat,undersomeplausibleas-sumptionsonthewaythatthevotersformtheirpreferences,therewillnotbeanyotheroligarchwhocouldhavegainedthisnumberofapprovalsifhehadstoodagainsttheselectedDogeinatwo-candidateelectionbythenalcollege,andthattheselectedDogeistheonlyoligarchsatisfyingthisproperty.NeitherLinesnorCogginsandPeralihaveanexplana-tionwhytheprotocolshouldhavemorethantworounds—oneusinglot-drawing,tomakeittoimpossibleforthoseinterestedininuencingtheresult(bybribingelectors,forexample)toforecastthemembershipofthenalcollege,andoneusingelection,totakeintoaccounttheviewsoftheelectorate.3.2.AssumptionsfortheanalysisOneoftheassumptionsthatwewillmakefortheanaly-sisisthattherewouldbefewcandidatesinanelectionforDoge.Theoreticallythenumberofcandidateswasequaltothenumberofvoters—anyoligarchcouldbecomeDoge.Inpractice,however,votersclusteredinfactionssupportingaparticularoligarchforDoge.Indeed,the75Dogeselectedinthevecenturiesinwhichthisprotocolwasusedhaveonly44surnamesbetweenthem,demonstratingthedomi-nanceofarelativelysmallnumberofpowerfulfamilies.ThenumberoffamiliesofoligarchsinVeniceinthelateThirteenthCenturywas206.In1297thelistofthesefami-lieswas“closed”,makingitrarerfornewfamiliestoobtaintherighttositontheGreatCouncil.ThetotalnumberoffamiliesintheGreatCouncilbetweenthatdateandtheendoftheVenetianRepublicwas532.However,bycompar-ingthelistofDogessuppliedbyNorwich([15],pp.641-2)withthedataonthemembershipoftheGreatCouncilsup-pliedbyRaines([16],Appendix1)itcanbeseenthat70ofthe75Dogeselectedusingthisprotocolcamefromfami-lieswhohadaseatontheGreatCouncilin1297.ThisisparticularlystrikinggiventhataccordingtoRaines,22.8%ofthesefamilieshaddiedoutby1400.Moreover,overathirdofthe75Dogescamefromtheselectgroupoftwenty-fourfamilieswhichweretraditionallyconsideredtobethefoundingfamiliesofVenice.(Infact,theycamefromjustthirteenofthesefamilies.)Apartfromthedominanceofafewfamilies,anotherrea-sonwhytheremightbefewcandidatesinpracticeisthattheDogeshipwasnotnecessarilyaveryenviableposition.TheDogehadtopaystateexpensesfromhisownpocket.Therewerelawsstrictlylimitinghisactionsandensuringthathecouldnotprotnanciallyfromhisrole.Thishasaparallelinleaderelectionprotocolsforcom-puters;thecomputerthatwinstheelectionwilltendtohavetocontributemoreresourcestotheoperationoftheprotocolforwhichitisleaderthannon-leadercomputersdo.Interestingly,ifanoligarchthoughtthattherewasadan-gerthathemightbeelectedDogeagainsthiswishes,thereisastrategythathecouldfollowtotrytoensurethathedidnotbecomeDogewhichisquitesimilartothestrategytobecomeDoge.Inbothcases,heshouldcollectaslargeafactionashecould.Inallcollegesbutthenalone,hisfactionwouldvoteforothermembersofthesamefaction.Theonlydifferenceisinthenalcollege,wherehisfactionwouldvoteforhimifhewishedtobeDoge,andforsome-oneelseifhedidnotwishtobeDoge.However,inthispaperwewillassumethatifanoligarchhasa(non-empty)factionsupportinghim,thenhedoeswishtobecomeDoge.Inordertoavoidspeculatingontheresultsofnegotia-tionsbetweendifferentfactions,wewillinitiallylimittheanalysistothecasewheretheelectoratecanbedividedintojusttwofactions,eachsupportingadifferentcandidate;andthatvotersdonotmovebetweenonefactionandtheotherduringtheelectionprocess.Wewillfurtherassumethatifthenumberofmembersofoneofthefactionsinaparticularelectoralcollegeismorethantheminimumapprovalnum-berfortheelectionbythiscollege,thenthemembersofthisfactionwillelectasmanymembersofthesamefactionaspossibletothenextcollege;andifontheotherhandthenumberofmembersofeachofthefactionsinthecollegeissmallerthantheminimumapprovalnumber,thenthepro-portionofthemembersofthedifferentfactionsinthenextcollegeischosentobeascloseaspossibletotheproportioninthecurrentcollege.(Weneedtomakesomeassumptionaboutwhathappensinthislastcase,becauseifneitherfac-tionhastheminimumnumberofapprovalsrequiredthenthetwofactionshavetonegotiatetodecidethemembership 0 0.1 0.2 0.3 0.4 0.5 0 0.05 0.1 0.15 0.2 0.25 0.3 0.35 0.4 0.45 0.5 Probability of minority dogeFraction of population in minority faction2 rounds 4 rounds 6 rounds 8 rounds 10 rounds Figure1.ProbabilityofelectingaminorityDoge,fortheprotocoltruncatedatrounds2,4,6,8,andnottruncated:lowerlinescorre-spondtoearliertruncationdonebytheelectoralcollegeforthesecond,fourth,sixth,eighthortenthround.The1268protocolhastenrounds,andtheotherthreelinesshowtheresultsoftruncatedpro-tocols.Thelineforeachprotocolliesabovethosefortheprotocolswhicharetruncatedversionsofit,sotheeffectofadditionalroundsofvotingistoincreasethechancesofmi-noritycandidatesbecomingDoge.However,ascanbeseen,theeffectofeachadditionalpairofroundsissmaller,anda12-roundprotocolisunlikelytohaveaverydifferenteffectfroma10-roundprotocol;sotheoligarchsweresensibletostoptheprotocolatthe10thround.Thisresultshowsthattheprotocolofferssomesupporttominorities—incontrasttoasimplemajorityprotocol,thisprotocoldoesofferthepossibilitythataminoritycandidatebecomesDoge—whileensuringthatthemostpopularcan-didateismostlikelytowin.SinceweassumethattheDogeissupportedbyamajor-ityofthenalcollege,whichhas41voters,acandidatewithfewerthan21supporterscannotbeelected.Insomemod-ernvotingsystemsusingproportionalrepresentationtoaf-fordsomeprotectionofminorities(suchastheelectoralsys-temsinGermany,RussiaandNewZealand),representationisonlyofferedtopartieswithatleast5%ofthevotes[17].Fivepercentofanelectorateof480votersis24voters.3.5.ProbabilityoftheelectionforcinganegotiationbetweenfactionsItispossiblethatduringtheelectionprocessthereissomecollegeinwhichneitherfactionhasasmanymembersinthecollegeastherequiredminimumnumberofapprovalvotesfortheelectionbythatcollege.Whenthathappened,themembersofthecollegeinthetwofactionswouldhavehadtonegotiatewitheachotherinordertodecidewhomtoelecttothenextcollege.Ifeitherfactionwasnotsatised,theywouldhavethepowertostalltheelectionindenitely.(Inpractice,noelectionofaDogestalled.)Thisfeatureoffersaprotectiontominoritiesinadditiontothepossibil-ityoftheelectionofaminorityDoge;sizeableminoritieswouldbequitelikelytoreachapositionduringtheelec-tionprocessduringwhichtheyhadsomepowertonegotiatefavourabletreatmentfromthemajority,evenifthemajoritycandidatewon.TheprobabilityofthishappeningcanbecalculatedbyrepeatedlyusingtheresultsofSubsection3.3.Theresultforn=480isplottedinFigure2. 0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 0 50 100 150 200 250 Probability of enforced negociationSize of minority faction Figure2.Probabilitythatatsomestagedur-ingtheelectionprocessthereisacollegeinwhichthefactionshavetonegotiateNotethatforn=480itismorelikelythannotthatthereissuchacollegeduringtheelectionprovidedthattheminoritycandidatehasatleast138supporters,about29%oftheelectorate.Ifthesizefoftheminorityfactionisatleast43,thentherewillbesuchacollegeatsomepointduringtheelec-tionifandonlyifthecollegeforthethirdroundisofthistype.Itfollowsthatiff43thereisasimpleformulafortheprobabilitythattheelectionprocessforcesanegotiationbetweenthefactions:itisequalto6Xi=3finf9in91Ourassumptionsaboutthebehaviourofvotersinsuchacol-legecanbedroppedwithoutaffectingthisformula.Iftherearemorethantwofactions,theprobabilityofthisoccurringduringtheelectionisofcourseevenhigher.Forthepotentialapplicationtoleaderelectionprotocolsincomputerscience,thisfeatureisnotveryuseful,because leaderelectionprotocols.Antonakopoulos[2]givesthefollowingtypicaldenitionofresilience(amongseveralequivalentvariants):Denition3.1(-resilience)Let�0beaconstantinde-pendentofthenumbernofvoters.Aleader-electionproto-colPiscalled-resilientfort=b(n)ifandonlyifforallsufcientlylargen,failP(n;b(n))1wherefailP(n;t)istheprobabilitythatanattackerwhocorruptsthebestpossiblesetoftvoterstofulllhisgoalwillfulllit.Antonakopoulosandotherresearchersinthisareafocusondistributedelectionswheretheuncorruptedvotersbe-haverandomly,andwhereattackersandcorruptedvotersmaytrytoinuencetheoutcomeoftheelectionbytun-ingtheir“random”inputs.IntheVenetianelection,un-corruptedvotersinthesamefactioncooperatewitheachother,andthelot-drawingduringtheprotocolisthesourceoftherandomness.Soresultspreviouslyprovedabouttheresilienceofleaderelectionprotocolsundertheassumptionthattheparticipantsarethesourceofrandomnessdonotnecessarilyapplyfortheelectionprotocolswearestudy-inghere.However,wecanstillusethedenitionabovetocomparetheresilienceofPM,PP,andPD.InordertoachieveaprobabilityatleastdofhavinghisfavouredcandidateelectedDogeundertheprotocolP,thenumberofcandidatesthatanattackerwillneedtocorrupt(foranychoiceofstrategiesbytheuncorruptedvoters,inalargeelectorate)isq(P;d)
n,whereq(P;d)=supfq:Pis(1d)-resilientfort=q
ngIflimn!1failP(n;q
n)isastrictlyincreasingfunctionofq—whichistrueifPisoneoftheprotocolsPP,PD—thenq(P;d)isjustequaltotheqsatisfyinglimn!1failP(n;q
n)=1dIfDisanintervalof[0,1]andP1,P2areelectionpro-tocols,wesaythatP1ismoreresilientthanP2onDifandonlyifq(P1;d)�q(P2;d)foralld2D.ForallprotocolsP,q(P;0)=0.Inthecasethatq(P;d)isacontinuousfunctionofd2[0;1]andthattheprobabilityofanattacker'scandidatewinningdoesnotdependonthepreciseidentityofthecorruptedvoters,butonlyontheirnumber,wehavethatq(P;d)+q(P;1d)=1.Itfol-lowsthatiftwoprotocolsP1andP2bothsatisfythiscase,andP1ismoreresilientthanP2onaninterval[c1;c2]with0c1c20:5,thenP2ismoreresilientthanP1on[1c2;1c1].ThesameresultholdsifP2isreplacedbysimplemajorityvoting(withacoin-tossforatie).Whencomparingdifferentprotocols,therefore,itisnotreasonabletoexpectoneprotocoltobemoreresilientthantheotherontheentireinterval[0,1].Iftheprotocolssatisfythecondi-tionsdescribedabove,ingeneralonewillbemoreresilientoversomepropersub-intervalof[0,0.5],andtheothermoreresilientinthemirrorsub-intervalof[0.5,1].Thechoiceofprotocolwilldependonwhetheritismoreimportanttopreventattackersfromgainingsmalladvantageseasily,ortohinderattackerswhohavetheabilitytocorruptalargeproportionoftheelectorate.Wewillnowgiveresultsforthethreeelectionproto-colsPM,PP,PDconsideredintheprevioussection.Itisstraightforwardtocheckthatq(PM;d)iszeroford=0and0.5otherwise,andq(PP;d)=dforalldin[0;1].Thevalueofthefunctionq(PD;d)doesnothavesuchasimpleexpression:itisthevalueqsatisfying9Xi=0[ai
9iqi(1q)9i]=dwhereaiistheprobabilitythatafactionwithfmembersandexactlyimembersinthecollegeforround3willhaveoneoftheirmemberselectedDoge,ifminff;nfg43.(Thisprobabilityisthesameforallvaluesoffandnsatisfyingminff;nfg43).ThevaluesofaicanbecalculatedusingtheresultsofSubsection3.3:theyarea0=a1=a2=0,a30:1955,a40:3929,a50:6071,a60:8045,a7=a8=a9=1.Thefunctionsq(PM;d),q(PP;d)andq(PD;d)areplot-tedinFigure4.Ontheinterval[0.0001,0.4999],PDismoreresilientthanPPandlessresilientthanPM.Onthemirrorinterval[0.5001,0.9999],PDislessresilientthanPPandmoreresilientthanPM.3.8.FindingacompromiseIfonedoesnotassumethattheoligarchsweredividedintotwomainfactionsonly,butthattherewasasetofeligi-blecandidatessupportedbygroupsofvarioussizes,thentheelectionprocesswouldsomehowhavetoarriveatacompromisecandidate.Weassumeinadditionthatthereissufcientfamiliaritybetweentheoligarchssothattheirpreferenceswereknowntoothersinprinciple.Toanalysehowacompromisemightemergeinthiselectionprocess,wehavemodelledtheelectionprocessasfollows.Eacholigarchhasanorderedlistoftenpreferredcandi-dates.Letcijbethecandidateinpositionjinthelistofoligarchi.Whenanewcollegeiselected,themembersoftheelectingcollegepickthoseoligarchswhosepreferencesareclosesttotheirown.Assumingthattheyholdstrongerviewsaboutcandidatesatthetopoftheirlist,weattachtheweight1 2jtopositionj.Thesimilarity(i;m)betweenthe 0 200 400 600 800 1000 1200 1400 1600 1800 2000 0 10 20 30 40 50 60 70 80 90 Elections wonCandidates10 rounds Figure6.Frequencyofwinspercandidateintheactualtenroundprotocol. 1 10 100 1000 0 10 20 30 40 50 60 70 80 90 Elections wonCandidates6 rounds 8 rounds 10 rounds 12 rounds Figure7.Frequencyofwinspercandidatein6,8,10,12roundprotocols,logarithmicscale.twelvecriteriaholdsfortheDogeelectionprotocol.Theproblemisthatthecriteriaarenotsuitableforjudgingran-domizedprotocols.Thecriteriagenerallytaketheform“IfXwins,andsomeparticularchangesaremadetothevoterpreferencesorsetofcandidates,thenXstillwins”;how-everforarandomizedprotocol,suchastheDogeelectionprotocol,ifXwinsandnochangesaremadetothevoterpreferencesorsetofcandidates,thenXmaynotwinnexttime.Cretney'sresourcesitealsolistselectionprotocols,andtwoofthoselistedarerandomized(“Random”,inwhicheverycandidatehasanequalprobabilityofwinning,and“Randomballot”,whichisPP).Randomizedelectionpro-tocolshavethedrawbackthatitmaybemoredifculttodetectwhentheyhavebeenincorrectlyimplemented.How-evertheiruseforimportantpurposesiscertainlynotcon-nedto13thcenturyVenice—forexample,juryselectionsystemsareusuallyrandomized.Thereappearsthereforetobeaneedforcriteriaforjudgingrandomizedelectionpro-tocols.ItispossibletogeneralizeeachofthecriterialistedbyCretneysothattheycanbesensiblyappliedtorandom-izedprotocols.Inmostofthecasesitisenoughjusttoreplace“Xwins”with“Xisthecandidatewiththehigh-estprobabilityofwinning”and“Xloses”by“Xisnotthecandidatewiththehighestprobabilityofwinning”.ThisgivesstraightforwardgeneralizationsoftheMajority,Con-sistency,Pareto,SecretPreferences,Concordet,ConcordetLoser,IndependenceofClones,andReversalSymmetrycri-teria.Sincetheyarestraightforwardwewillnotgivethedenitionsofthesegeneralisedcriteriahere.InordertogeneralisetheSmithcriteriaandLocalInde-pendencefromIrrelevantAlternatives,itisusefultointro-ducetheideaofageneralisedSmithset.Thisisthesmall-estnonemptysetofcandidatessuchthatforallYinthesetandZnotintheset,YhasahigherprobabilitythanZofwinningtheelectionifallcandidatesbutYandZareeliminated.Notethatthesetofallsetswiththispropertyisnonemptyandnested;itfollowsthatthegeneralisedSmithsetalwaysexists,andisunique.ItisequaltotheusualSmithsetiftheelectionprotocolisnotrandomized.TheSmith,LocalIndependencefromIrrelevantAlter-natives,MonotonicityandMutualMajoritycriteriacanbegeneralisedtothefollowing:Criterion4.1.(GeneralisedSmith)IfXhasthehighestprobabilityofwinning,Xmustbeamemberofthegener-alisedSmithset.Criterion4.2.(GeneralisedLocalIndependencefromIrrelevantAlternatives)SupposeXisthecandidatewiththehighestprobabilityofwinning,anewcandidateYisadded,andYisnotinthegeneralisedSmithset.ThenX 0 5 10 15 20 25 30 35 0 20 40 60 80 100 120 date of death or resignation minus date of electionDoges in chronological order Figure8.LengthsofserviceofDogestionminusthedateelected—bythese75Dogeswere6.85and6respectively.(Thiscomparestomeanandmedianreignlengthsof19.85and14yearsfortheEnglishmonar-chswhosereignsbeganwithinthetimeperiodduringwhichthisprotocolwasusedinVenice).Incontrast,themeanandmedianlengthsofserviceofthe43Dogesbefore1268were11.35and11years.Thus,ifitiscorrectthattheoligarchswishedtoreducetheincumbentadvantagebyelectingDo-geswhowereunlikelytoremainformanyyears,itappearsthatthe1268protocolwasmoreeffectivethantheprevi-ous,simplerelectionprotocolsatreectingthiswishoftheelectorate.Figure8showsthelengthsofserviceoftheDogesinorderofelection;theDogesfromnumber44onwardswereelectedusingthe1268protocol.ItcanbeseenthatDogeswith5orfeweryearsofserviceoccurmorefrequentlyaftertheintroductionofthisprotocol.TheDogewiththelongestservice,34years,waselectedpost1268;interestinglythiswasFrancescoFoscari,theal-legedbeneciaryoftacticalvotingmentionedearlierinthispaper.Itcanbespeculatedthatiftherevisedelectionruleusingconcurrentvotingduringballotshadbeenintroducedbeforethiselectionratherthanafterit,theelectionmighthavebeenwoninsteadbytheadmiralPietroLoredan,con-sideredthemostlikelycandidatefortheDogeship,whodied16yearsaftertheelection.AnotherwayofthinkingaboutincumbentbiasintheelectionoftheDogeistoconsidernottheissueofthesameoligarchwinningtwoconsecutiveelections(whichwasim-possible),buttheissueoftheelectionofanoligarchfromthesamefamilyasthepreviousDoge.Thishappenedtwiceinthe75electionsafter1268;ineachcasethetwosucces-siveDogeswerebrothers.Incontrast,sevenofthe43pre-1268DogescamefromthepreviousDoge'sfamily,and—ominouslyforaRepublic—insixofthesecasestheDoge-shippassedfromfathertoson.Thereasonforthereductionoftheadvantagetotheincumbentfamilyappearstobetheabolitioninthemid-11thcenturyofthepracticeofallowingDogestoappointaco-regent,whowaseffectivelyhisdes-ignatedsuccessor([15],p.66).NoDogesfromtheincum-bentfamilywereelectedbetweenthenand1268.However,thelargenumberofroundsofthe1268protocolmayhavehelpedtoensurethatastrongincumbentbiasdidnotcreepbackafterthisdate.TheelectionoftwopairsofsuccessiveDogesfromthesamefamilyafter1268mighthavebeentheresultofresid-ualincumbentbias,butitisalsoconsistentwiththerebeingnobiasinfavourof(oragainst)theincumbentfamily,butastrongbiaslimitingthenumberoffamiliesfromwhichtheDogemightbeelected.Ifeachofthe75Dogesafter1268hadbeenindependentlyselectedinsuchawaythateachofthe44familieswhichproducedDogeshadanequalchanceofbeingthefamilyoftheDogeselected,andnootherfami-lieshadachance,thenitwouldhavebeen(just)morelikelythannotthatatleasttwooftheDogesselectedwouldbefromthesamefamilyastheDogeprecedingthem.Ifthenumberoffamilieswithachancehadbeen206—thenum-berofoligarchfamiliesinthelate13thcentury—ratherthan44,therewouldstillhavebeena5%chanceoftwoormoresuchDogesbeingselected.(WearenotsuggestingthattheDogeswereselectedthisway.Thiscalculationisonlyin-tendedtoshowthatthedatadonotimplyanincumbentbiasafter1268.)6.Whythesenumbers?Lines([11],p.157)saysaboutthecollegesizesandmin-imumapprovalnumbersforthe1268protocolthat“Aftersomeefforttondalogicalorprobabilisticstructurebe-hindthenumbersusedinthescheme,InallyattributedthemtothewhimsofZorziand/orhiscohorts.”(The1268protocolwasdesignedeitherbyRuggeroZorzi,orbyZorziandothers.)Inanearlierversionoftheprotocol,usedin1178,theas-semblyofallthevoterselectedacollegeof4,whoelectedacollegeof40,whoelectedtheDogebymajorityvoting.Theminimumnumberofapprovalvotesrequiredfortheelec-tionbythecollegeof4was3.Inalltheroundsbutthenaloneofthe1268protocol,theminimumnumberofapprovalvotesrequiredisd3c=4e,wherecisthecurrentcollegesize.Asfarasweareaware,no-oneelseanalysingthisprotocolhasnotedthissimpleformula,whichisastraightforwardgeneralizationofthevalueof3foracollegeof4.Ithasthegeneralpropertythatifthecollegeissplitintorfactionsofsizesf1f2:::fr,thennotwoorthreefactionscanunitetoobtaintherequirednumberofapprovalvotesunlessatleastoneofthesefactionshassizef1;soitisnotpossibleforapairortripletofalliedsmallerfactionstooutvotethelargestfaction.Infact,forthecollegesizesusedinthepro- mindsbetweenrounds,ortoforgealliancesadvancingtheirsecond-choicecandidates.Ithasbeensuggestedthatthecomplexityoftheproto-colwasanaestheticchoicebytheVenetianoligarchs.Cer-tainlytheVenetianRepublicproducedsomeverycomplexandhighlyornamentedmusicandarchitecture.Itisalsopossiblethatitwascomplexsimplybecausenosimplerpro-tocolwiththepropertiesthatwerewantedhadbeenfound.Wesuspecthoweverthatthiscomplexityservedaparticularfunction:thatofsecuritytheatre.8.1.SecuritytheatreintheVenetianRepublicSchneier[18]hasusedthephrase“securitytheatre”todescribepublicactionswhichdonotincreasesecurity,butwhicharedesignedtomakethepublicthinkthattheorgani-zationcarryingouttheactionsistakingsecurityseriously.(Hedescribessomeexamplesofthisinresponsetothe9/11suicideattacks.)Thisphraseisusuallyusedpejoratively.However,securitytheatrehaspositiveaspectstoo,providedthatitisnotusedasasubstituteforactionsthatwouldactu-allyimprovesecurity.InthecontextoftheelectionoftheDoge,thecomplex-ityoftheprotocolhadtheeffectthatalltheoligarchstookpartinalong,involvedritualinwhichtheydemonstratedindividuallyandcollectivelytoeachotherthattheytookse-riouslytheirresponsibilitytotrytoelectaDogewhowouldactforthegoodofVenice,andalsothattheywouldsubmittotheruleoftheDogeafterhewaselected.Thisdemonstra-tionwasparticularlyimportantgiventhedisastrousconse-quencesinotherMediaevalItaliancitystatesofunsuitablerulersorcivilstrifebetweendifferentaristocraticfactions.Itwouldhaveserved,too,ascommercialbrand-buildingforVenice,reassuringtheoligarchs'customersandtrad-ingpartnersthatthecitywaslikelytoremainstableandbusiness-friendly.Aftertheelection,thesecuritytheatrecontinuedforsev-eraldaysofelaborateprocessionsandparties.Thereisalsosomeevidenceofsecuritytheatreoutsidetheelectionpe-riod.A16thcenturyengravingbyMateoPagandepictingthelavishparadewhichtookplaceinVeniceeachyearonPalmSundayshowsthebalotinointheparade,inapromi-nentposition—nexttotheGrandChancellor—anddressedinwhatappearstobeaspecialcostume(KurtzmanandKoldau[8],Figure18).8.2.AsimpliedprotocolInthecontextofleaderelectionprotocolsincomputersystems,itismoresensibletoimplementsecuritytheatreby,forexample,publicizingprovenresultsaboutthese-curityofthesystemsandprotocolsusedthanbymakingtheprotocolsgratuitouslycomplicated.WethereforeofferasimpliedversionoftheDogeelectionprotocol.Thesimpliedprotocolhassevenroundsratherthanten,anditscollegesizesforroundstwotosevenare9,45,9,45,9,45,withaminimumof7approvalsoutof9requiredineachroundofelectiontype:otherwiseitisthesameastheoriginal.Forallfactionsizestheoriginalandsimpliedprotocolsdifferbylessthan0.001inthemeasuresplottedinFigures1and4,andbylessthan0.0002inthemeasuresplottedinFigures2and3.9AcknowledgementsMirandaMowbraythanksMatthewHennesseyforin-formingheraboutthisextraordinaryprotocol;AlessandraOriforVenetianlinguisticadvice;theanonymousreview-ersfortheirhelpfulcomments;andHPLabs,forlettingherstudythehabitsofVenetianoligarchsaspartofherjob.DieterGollmannthanksHaraldSauffforhishelpinper-formingtheexperimentsofSection3.8.References[1]M.K.Aguilera,C.Delporte-Gallet,H.Fauconnier,andS.Toueg.Communication-efcientleaderelectionandcon-sensuswithlimitedlinksynchrony.Proc.PrinciplesofDis-tributedComputing(PODC'04),pages328–337,July2004.[2]S.Antonakopoulos.Fastleader-electionprotocolswithboundedcheaters'edge.Proc.STOC'06,pages187–196,May2006.[3]A.CaplinandB.Nalebuff.On64%-majorityrule.Econo-metrica,56(4):787–814,July1998.[4]J.S.CogginsandC.F.Perali.64%majorityruleinducalVenice:VotingfortheDoge.PublicChoice,97:709–723,1998.[5]B.Cretney.TheElectionMethodsResource.http://concordet.org/emr,2007.[6]H.Garcia-Molina.Electionsinadistributedcomputingsys-tem.IEEETransactionsonComputers,C-31(1):49–59,Jan-uary1982.[7]M.Haahr.random.orgsite.http://www.random.org,1998–2007.[8]J.KurtzmanandL.M.Koldau.Trombe,trombed'argento,trombesquarciate,tromboni,andpifferiinVenetianproces-sionsandceremoniesofthesixteenthandseventeenthcen-turies.JournalofSeventeenth-CenturyMusic,5(1),2002.[9]L.Lamport.Paxosmadesimple.ACMSIGACTNews,32(4):18–25,December2001.[10]D.Lee.Livingadoge'slife.LondonEveningStandard,October2004.[11]M.Lines.Approvalvotingandstrategyanalysis:Avenetianexample.TheoryandDecision,20:155–172,1986.[12]G.Maranini.LaCostituzionediVenezia,volume2.LaNuovaItaliaEditrice,1931. Round typesizeofcollegeapprovals 1 lotn– 2 lot30– 3 election97 4 lot40– 5 election129 6 lot25– 7 election97 8 lot45– 9 election119 10 Miranda Mowbray, Dieter GollmannEnterprise Systems and Storage Laboratory This paper discusses the protocol used for electing the Doge of Venicebetween 1268 and the end of the Republic in 1797. We will show that i t has some useful properties that in addition to being interesting inthemselves, also suggest that its fundamental design principle is worthinvestigating for application to leader election protocols in compute r science. For example it gives some opportunities to minorities whileensuring that more popular candidates are more likely to win, and offerssome resistance to corruption of voters. The most obvious feature of this protocol is that it is complicated an d would have taken a long time to carry out. We will advance a hypothesisas to why it is so complicated, and describe a simplified protocol withvery similar features. * Internal Accession Date Only Personal use of this material is permitted. Permission to reprint/republish this material for advertising or promotional purposes or for creating new collective works for resale or distribution to servers or lists, or to reuse any copyrighted component of this work in other works must be obtained from the IEEE. Hamburg University of Technology IEEE Computer Security Foundations Symposium, 6-8 July 2007, Venice, Italy Copyright 2007 IEEE Approved for External Publication