Ismael, his older brother Bayez and their driver had just pulled into traffic behind a convoy of four Chevrolet Suburbans, which police believe belonged to an American security contractor stationed nearby. The back door of the last vehicle swung open, the brothers said in interviews, and a man wearing sunglasses and a tan flak jacket leaned out and leveled his rifle.

"I thought he was just trying to scare us, like they usually do, to keep us back. But then he fired," said Ismael, 20. His scalp was still marked by a bald patch and four-inch purple scar from a bullet that grazed his head and left him bleeding in the back seat of his Toyota Land Cruiser.

"Everything is cloudy after that," he said.

A U.S. investigation of the July 14 incident concluded that no American contractors were responsible, a finding disputed by the Ismaels, other witnesses, local politicians and the city's top security official, who termed it a coverup. No one has yet been held responsible.

Recent shootings of Iraqi civilians, allegedly involving the legion of U.S., British and other foreign security contractors operating in the country, are drawing increasing concern from Iraqi officials and U.S. commanders who say they undermine relations between foreign military forces and Iraqi civilians.

Private security companies pervade Iraq's dusty highways, their distinctive sport-utility vehicles packed with men waving rifles to clear traffic in their path. Theirs are among the most dangerous jobs in the country: escorting convoys, guarding dignitaries and protecting infrastructure from insurgent attacks. But their activities have drawn scrutiny both here and in Washington after allegations of indiscriminate shootings and other recklessness have given rise to charges of inadequate oversight.

"These guys run loose in this country and do stupid stuff. There's no authority over them, so you can't come down on them hard when they escalate force," said Brig. Gen. Karl R. Horst, deputy commander of the 3rd Infantry Division, which is responsible for security in and around Baghdad. "They shoot people, and someone else has to deal with the aftermath. It happens all over the place."

No tally of such incidents has been made public, and Aegis, a British security company that helps manage contractors in Baghdad and maintains an operations center in the capital's fortified Green Zone, declined to answer questions. In the rare instances when police reports are filed, the U.S. military is often blamed for the actions of private companies, according to Adnan Asadi, the deputy interior minister responsible for overseeing security companies.

"People always say the Army did it, and even our police don't always know the difference," he said.

The shootings became so frequent in Baghdad this summer that Horst started keeping his own count in a white spiral notebook he uses to record daily events. Between May and July, he said, he tracked at least a dozen shootings of civilians by contractors, in which six Iraqis were killed and three wounded. The bloodiest case came on May 12 in the neighborhood of New Baghdad. A contractor opened fire on an approaching car, which then veered into a crowd. Two days after the incident, American soldiers patrolling the same block were attacked with a roadside bomb.

On May 14, in another part of the city, private security guards working for the U.S. Embassy shot and killed at least one Iraqi civilian while transporting diplomats from the Green Zone, according to an embassy official who spoke on condition he not be named. Two security contractors were dismissed from their jobs over the incident.

Employees of private security firms are immune from prosecution in Iraq, under an order adopted into law last year by Iraq's interim government. The most severe punishment that can be applied to them is revocation of their license and dismissal from their job, U.S. officials said. Their heavy presence stems in large part from the Pentagon's attempts to keep troop numbers down by privatizing jobs that would once have been performed by American forces.

There are now at least 36 foreign security companies -- most from the United States and Britain -- and 16 Iraqi firms registered to operate here, according to the Interior Ministry, and as many as 50 more are believed to have set up shop illegally. Their total workforce is estimated at 25,000; many are military veterans, though levels of experience vary. As of December, contracts to provide security for U.S. government agencies and reconstruction firms in Iraq had surpassed $766 million, according to a recent Government Accountability Office report.

"As the security world rapidly expanded, I think some had to incorporate into their labor pool people with significantly less experience," said Harry Schute, who commanded an Army civil affairs battalion in northern Iraq from March 2003 until early 2004 and now serves as an adviser to the Kurdistan regional government, which has its capital in Irbil.

Johann R. Jones, director of the Private Security Company Association of Iraq, a trade organization representing such companies, known as PSCs, disputed Horst's characterization of their performance in an e-mail response to written questions.

"Whilst the behavior of a few PSCs is unhelpful, we have to also keep in mind that 'bad apples' are present in all organizations, including the MNF-I," wrote Jones, using the acronym for Multinational Forces-Iraq, the U.S.-led military coalition here. "There have been huge strides amongst the Iraqi government to regulate and maintain accountability regarding PSCs. There have also been huge strides within the PSC community to identify those that behave in an unacceptable manner."

The U.S. Embassy official said that he was "extremely concerned" about shooting incidents involving private security companies but that the vast majority of security contractors were highly professional. Of 122 shootings by contractors protecting embassy officials since July 2004, only three have resulted in disciplinary actions, according to U.S. officials who monitor private security companies.

"Look, we're in a war zone," the official said. "They are high targets. The insurgents know when they see SUVs rolling down the street. There are people trying to kill them all the time, and sometimes they have to respond."

Security and other contractors working in Iraq have been frequent victims of violence. According to a Defense Department report to Congress last month, 166 contractors were killed and 1,005 wounded between May 1, 2003, and Oct. 28, 2004. The most publicized incident came on March 31, 2004, when four employees of Blackwater Security Consulting, a North Carolina-based company, were killed and their bodies dragged through the volatile western city of Fallujah.

While many security companies perform military-style tasks, often on behalf of the U.S. government, they are not under the armed services' command. In response to a congressional request for more information on oversight of security contractors, the Pentagon said the military's relationship with them was "one of coordination, not control."

Horst declined to provide the name of the contractors whose employees were involved in the 12 shootings he documented in the Baghdad area. But he left no doubt that he believed the May 12 incident, in which three people were killed, led directly to the attack on his soldiers that came days later on the same block.

"Do you think that's an insurgent action? Hell no," Horst said. "That's someone paying us back because their people got killed. And we had absolutely nothing to do with it."

Asadi, the Interior Ministry official, said Iraqi civilians nevertheless think private security guards are American soldiers. "They have the same bodies, the same looks," he said. "The only difference is the Humvees," vehicles used by the military but not by private firms.

In May, Asadi sent a brief letter to registered security companies warning them to obey local laws or risk having their licenses revoked. "The cancellation will be circulated to all state offices, with the aim of shunning any dealing with you," he wrote. On May 27, after the shootings in Baghdad, Horst called a meeting with representatives of security firms and police officials at the U.S. Embassy.

"We had a dialogue about propriety and conduct and consequences management," Horst said. "Our philosophy is 'make no new enemies,' and that's what I tried to impress upon these guys. They don't have to think about the consequences of what they do, but we do."

The next day, the sometimes contentious relationship between security companies and the U.S. military burst into the open. Marines in the western province of Anbar detained 19 security contractors from another North Carolina-based outfit, Zapata Engineering, who allegedly shot at U.S. forces near Fallujah.

Horst said his soldiers had had a run-in earlier that day with the same 19 workers. The contractors -- 16 Americans and three Iraqis -- were traveling west from Baghdad in a convoy of white Suburbans. As they passed the Abu Ghraib prison, whose perimeter is guarded by Horst's soldiers, they were shooting indiscriminately at the sides of the road, the general said.

"They were doing what we call 'clearing by fire,' " Horst said. "They were shooting everything they see. They blow through here and they shot at our guys and they just kept going. No one was shooting back."

The shooting of Ismael in Irbil came six weeks later. Police said the convoy of Suburbans quickly proceeded from the scene to a base operated by the U.S. Agency for International Development that is guarded by DynCorp International, an American firm.

An investigation by U.S. officials concluded that "the evidence clearly indicates the vehicle was fired on from the rear by an as yet unknown party and not from the front by the" security company, according to a July 15 report filed with Kurdish security officials.

The report offered "working theories" to explain the shooting, including the possibility that it resulted from an insurgent ambush in which the Ismaels' Land Cruiser was simply "in the wrong place at the wrong time," or an attempt to assassinate Bayez Ismael, a Kurdistan Democratic Party official.

Abdullah Ali, director of the Irbil security police, called the U.S. report "three pages of lies to try to cover up that their company was involved."

"We looked at all the evidence," he continued. "Witnesses only saw a shot from the front. And we found his hair and blood towards the back window, which supports that. We are 1 million percent sure."

In an e-mail response to questions, DynCorp spokesman Gregory Lagana pointed to the embassy investigation. "We have confirmed that our people in the Irbil area did not leave their compound that day," he wrote.