Earlier reports quickly identified the role of pro-Russian partisans in amplifying the hashtag, but Watts’ claims are based on different data, generated by a monitoring project called Hamilton 68. Named after founding father Alexander Hamilton’s warning about the danger of foreign influence, Hamilton 68 monitors 600 Twitter accounts “linked to Russian influence operations.” That includes both automated bot accounts and what Hamilton 68 describes as “trolls.”

To trace Russian influence, Hamilton 68 begins with official Russian outlets or explicitly pro-Russian mouthpieces, then identifies other accounts pushing the same topics or narratives. Watts described the findings and methods in an interview with NPR’s Weekend Edition this morning.

Get Data Sheet, Fortune’s technology newsletter.

Much of what is tweeted by the Russian Twitter network, Watts says, may not look like Russian propaganda.

“The first thing you have to do is infiltrate the audience,” he told NPR. “If you look at the top hashtags, oftentimes they’re very common hashtags you’d see [in] a very pro-Trump audience.” For instance, amidst fallout from last week’s white supremacist terror attack in Charlottesville, Hamilton 68 shows Russian influence networks dominated by the hashtag “antifa” – a term often used to criticize the counterprotestors who were targeted in the attack.

According to Watts, Russian targeting of McMaster is in line with the country’s hostility to international alliances including the EU and NATO, which McMaster has expressed support for despite President Trump’s sometimes unclear stance.

“The long view of the Russian active measures program is chaos and disunity among the American government,” Watts said. “Anytime there’s a rift… they want to amplify those rifts.”