A month after swarms of drones began appearing over Colorado and Nebraska, their provenance remains a mystery. How to even start? Authorities have admonished that it’s illegal to shoot them down, and no one’s managed to intercept a tell-tale electronic signal. No one’s even managed to take a clear picture of one. But there might be another way.

The scope and persistence of the operation implies that some significant entity is behind them — someone, most likely, with too much to lose to risk operating without the necessary paperwork from the Federal Aviation Administration. Could the answer to the riddle lie within an FAA database?

There are two sets of records you’d want to explore because there are two processes under which the FAA permits commercial drone flight. The first is called Part 107. To operate under these guidelines, an operator gets a Remote Pilot Certificate and registers a drone with the FAA. They can then fly pretty much anywhere, so long as they follow certain restrictions: They can’t operate at night, or fly over people, or operate from a moving vehicle, for instance. If they want to do any of these things they need to apply for a waiver.

The second form of permission is called a Certificate of Authorization, or COA. In the past these have tended to be used by public agencies like the Department of the Interior and the branches of the military. These are fairly cumbersome to obtain, but once in hand allow an operator a good deal of freedom within a defined area. They’ve fallen out of favor in recent years, however, and a search of the FAA’s database suggests that the most recent ones expired in 2015. “Many agencies are choosing to operate under Part 107,” FAA spokesperson Ian Gregor explained via email. So we can forget about these.

Back to Part 107. Based on published accounts, the Colorado drones always fly at night, sometimes fly in coordinated swarms, and fly significant distances. To do all of these things, an operator would need waivers 107.29 (flying at night), 107.31 (flying beyond visual range of the operator), and 107.35 (multiple drones flown by one operator). Out of the thousands of waivers issued, only five companies were issued a waiver valid for all three. One of those has since gone out of business.

That leaves four.

To tighten the search, we can compare the companies’ drones to the ones described in accounts of the Colorado swarms. According to the Times, the craft have “wingspans of up to 6 feet.” Only two of the four companies operate drones that have wings; the others, such as the Flirtey Eagle, are copters.

The first of the winged drones is flown by a company called Zipline, which builds and operates UAVs to deliver blood-transfusion supplies to medical facilities in remote Rwanda and Ghana. I sent an email to their PR department and within minutes got a reply from their communications director, Justin Hamilton: “Is this about Colorado UFOs?” I replied that it was, and asked if Zipline was behind them. He wrote: “It is not. But I would love to know who it is!”

Over the phone he told me that Zipline had carried out test flights in the past but is not doing so anymore, since its UAVs are operational and already carrying out their missions in the field. “We’ve made tens of thousands of deliveries, and we make more every day,” he said.

That leaves No. 2, an outfit called Wing Aviation, of Mountain View California. Wing began life within the secretive confines of Google’s Project X, then later got spun off as a separate entity and now operates under the umbrella of Google’s parent company, Alphabet.

Last year, as part of an FAA initiative, Wing launched what it called the first “commercial air delivery service via drone directly to homes in the United States.” In collaboration with FedEx and Walgreens, the company’s white-and-yellow winged drones began delivering small packages to homes around Christiansburg, Virginia. Arriving at its destination, each drone hovers as it lowers its cargo on a long string to the ground.

Interestingly, the drones spotted over Colorado and Nebraska also hover. As the Lincoln Journal Star reported, “Some were flying formations in small groups, others were hovering. One floated above the town for more than an hour.”

Wing’s drones reportedly have a wingspan of “about three feet.” They have 12 small rotors arranged along two longitudinal beams that it uses to hover and two larger propellers for forward flight. In the prototype stage they could make round trips of about nine miles.

Unsurprisingly, given its roots in Google’s “Moonshot Factory,” Wing has ambitions beyond mere package delivery. This past June it took part in an FAA pilot program called “Unmanned Traffic Management” that allows robot planes to communicate with one another to safely navigate shared airspace. As Wing later stated in an article on Medium, the project “directed Wing and other participants to execute a series of exercises involving multiple aircraft in low-altitude airspace.” Hmmm …

Allison Sylte, a reporter with 9News.com in Denver, wrote an article that went through a comprehensive list of who might be the culprit. When she called a PR rep at Google, he told her, “It’s not Wing.” When she followed up by phone, “he emphasized that it was not Google,” Sylte told me via email, adding that he “did acknowledge Wing has done some testing up there since it’s a pretty sparsely populated area. He emphasized though that it wasn’t them and they aren’t in Colorado or Nebraska right now.”

That only piqued my curiosity. In the past Google has been very tight-lipped, even secretive, in its dealings with the press — most memorably in 2013, when mysterious barges appeared at Treasure Island in San Francisco. After CNET found that the barges were linked to Google, the company refused to comment until two weeks later, when it fessed up in a public statement that claimed, “We’re exploring using the barge as an interactive space where people can learn about new technology.” The vessels were scrapped without further comment soon after.

Was it possible that Google was being less than forthcoming about the drone swarms? Was it possible that a Google spokesperson might not be fully informed about the doings of a sister company? I cadged contact information from Sylte and fired off an email of my own to Google. The reply came directly from Wing spokesperson Alexa Dennett. “This is not Wing — we don’t fly in Colorado,” she wrote. Later, over the phone, she told me that Wing only currently flies in two places in the United States, one in California and the other in Virginia. As for Colorado? “It’s got nothing to do with us, at all,” she said, emphatically. “We always engage the community before we fly in an area.”

That would seem to be the end of the road — but there’s one more possibility. An idea that has gained a foothold on the internet is that the U.S. military is carrying out the nighttime maneuvers. The Colorado Springs Gazette has pointed out that Air Force Global Strike Command has been conducting counter-drone exercises at F.E. Warren Air Force Base in Cheyenne, Wyoming. The command oversees Minuteman silos in northeastern Colorado and western Nebraska, the general region where the drone swarms have been reported. Maybe the mysterious craft are involved with defending nuclear missiles?

There are a couple of problems with this theory, however. One is that the Air Force would need to have a COA or Part 107 waivers to operate in the area, and it has neither. Another is that the base denies it. When Sylte contacted them, she says, “their people vehemently said it is not them.”

All in all, it would seem that either someone is operating a drone swarm without authorization, or else someone is lying.

The FAA’s investigation is ongoing.