Following a legal complaint made by Erinys International Limited, the Guardian agreed to publish this statement from the firm concerning this article:

Erinys Iraq Ltd had a contract with the US Army Corps of Engineers from 2003 to 2007. That contract obliged Erinys to follow the Rules for Use of Force ("RUF") and Rules for Escalation of Force ("EOF") as laid down in US Army Regulations 19014 on the "Carrying of Firearms and Use of Force for Law Enforcement and Security Duties", as issued in March 1993. These rules prohibit warning shots and shots that might endanger bystanders. All shots must be aimed shots and must only be fired in self-defence. All Erinys staff were issued with a summary of these rules and were given regular training on them. There were occasions when Erinys staff employed armed force in defence of themselves or their clients, but this was done in accordance with the terms of RUF and, in all cases where Erinys staff fired a weapon during the term of the USACE contract, a serious incident report was completed and sent to USACE, who had the option of mounting an investigation if they considered it appropriate.

Shortly after 10am on 14 May 2005, a convoy of private security guards from Blackwater riding down "Route Irish" – the Baghdad airport road – shot up a civilian Iraqi vehicle. While they were at it, the Blackwater men fired shots over the heads of a group of soldiers from the 69th Regiment of the US Army before they sped away heading west in their white armoured truck. When the dust cleared, the Iraqi driver was dead and his wife and daughter were injured.

A terse, 57-word dispatch in the Iraq war logs published by WikiLeaks is the first public evidence of the shooting, as recorded by the US military.

The incident is one of several dozen involving private security companies in Iraq – almost all of which have never been previously reported – that led to an "escalation of force", which is military parlance for a series of actions that begins with nonlethal measures (such as visual signals with flags, spotlights or flares), but may graduate to potentially lethal force, with warning shots, disabling shots (to vehicle tyres) or, if all other measures have failed, deadly shots, depending on the perceived level of threat. Blackwater, the company from Moyock, North Carolina, is responsible for about half of the incidents, closely followed by Erinys, a British private security company registered in the Virgin Islands, which seems to have an unusually high number of vehicle crashes.

On my four visits to Iraq in the last seven years, I learned quickly to steer clear of the fast-moving vehicles belonging to these private security companies. The men – sporting identical reflective wrap-around sunglasses, bullet-proof jackets – would aim their high-powered assault rifles and shout "Imshi" ("Move") at any vehicle that came within a 50m perimeter. Sometimes, they would throw plastic water bottles to shock pedestrians into staying away.

Easily the best-known private security company is Blackwater (recently renamed Xe), which rocketed to fame three years ago when four company security guards, escorting a convoy of US state department vehicles en route to a meeting in western Baghdad, opened fire in Nisour Square in Baghdad killing 17 Iraqi civilians. Yet, a query of the Iraq war logs for "Blackwater" or "Nisour Square" turns up nothing, at first.

In this failure to identify what is probably the most notorious carnage of Iraqi civilians, the strengths and weakness of the military reporting process (and, by association, WikiLeaks) become startlingly clear. Had the media not reported this incident, there would be no way to identify the company or the location in which this massacre took place. Initially, I wondered: was it possible that the soldier who recorded the incident made a mistake or that the record was erased?

Eventually, I tracked down the incident by trying a few other methods. It is easy to see why I missed the record: there is no mention of the company, or the location, and even the death toll is incorrectly recorded as nine, suggesting that the Pentagon casualty record is incomplete.

Human rights investigators know this problem only too well. Media reports are often incomplete and government reports are sometimes deliberately vague. They are just a starting point from which painstaking research is needed to build up a true picture of what has happened.

Quite possibly, there were many more incidents in which civilians were injured, or even killed, which were never reported. Some of the reports may have been altered before they were entered into the military system. But given the other records that I found, at the very least, WikiLeaks has revealed that Blackwater and other private security companies are guilty of many more injuries and killings than the media have previously reported.

Today, there as many as 40,000 armed private security contractors working in Afghanistan and Iraq, according to data collected by Commission on Wartime Contracting staff during the first quarter of 2010.

Some of them are ill-paid ex-soldiers from countries like Sierra Leone who make just $250 a month; others are former US soldiers, who are paid $500 or more per day. These men are often doing the very same jobs that soldiers once did – like guard duty – but with a lot less accountability.

Until quite recently, these men with guns were untouchable: they were protected from any kind of prosecution by Coalition Provisional Authority Order No 17, issued by Paul Bremer, the US diplomat charged with running Iraq after the 2003 invasion.

For example, Andrew J Moonen, a Blackwater employee, who has been accused of killing a guard assigned to an Iraqi vice-president on 24 December 2006, was spirited out of the country and has never faced charges in Iraq. Nor have the five men accused of opening fire in Nisour Square: Donald Ball, Dustin Laurent Heard, Evan Shawn Liberty Nicholas Abram Slatten and Paul Alvin Slough. Lawsuits in the US have also failed.

Blackwater and Erinys were not the only ones who acted with seeming impunity. Perhaps the most egregious incident occurred on 28 May 2005, when the US marines came under fire from four white Ford pickup trucks and a grey Excursion sports utility vehicle "recklessly driving through Fallujah traveling west – and firing sporadically at vehicles".

The shooters worked for Zapata Engineering, one of five companies originally hired under a $200m contract to supervise the destruction and storage of US military ammunition worldwide. They were paid well for this work: each company manager earned an average of $275,000 a year, under their contract.

Eventually, one of the Zapata vehicles ran over a spike strip in the road near a guard house under the control of the US Marines. The Marines placed 19 Zapata employees under arrest.

At the time, Lawrence Peter, the director of the Private Security Company Association of Iraq, told my colleague David Phinney at CorpWatch:

"I can say without a shadow of a doubt that there is no company named Zapata that is a licensed private security company under the terms of CPA Memorandum 17. I do not know under what legal authority those men thought they were operating, but it was not in keeping with the law of Iraq nor consistent with what professional, responsible and law-abiding private security companies are doing here."

But Iraqis cannot tell which of these companies are licensed and which are not. Technically, they could complain to the military or raise the matter with yet another private military company named Aegis Defence from Britain, which was in charge of monitoring the movements of fellow private security contractors, under a $293m contract issued in June 2004. Yet Aegis hardly inspired confidence – one of their employees caused an uproar when he uploaded a video of security contractors shooting at Iraqis, with an Elvis Presley soundtrack to match.

Things got even worse when the Washington Post published an article about yet another security company named Triple Canopy, in which team leader Jacob C Washbourne was quoted as saying: "I want to kill somebody today."

Today, the Pentagon says that the random shootings are a thing of the past. In May 2008, an Armed Contractor Oversight Bureau (ACOB) was set up (pdf) by the US government in Iraq. Unfortunately, there is no website or any other public way to contact this important body.

Perhaps the most worrying news about private military contractors came on 18 August 2010, when the New York Times revealed that the US government was planning to double the number of private security contractors in Iraq:

"Defending five fortified compounds across the country, the security contractors would operate radars to warn of enemy rocket attacks, search for roadside bombs, fly reconnaissance drones and even staff quick reaction forces to aid civilians in distress, the officials said."

It's not just Iraqis who are worried. At a hearing in congress on 23 September 2010, Michael Thibault, co-chair of the commission on wartime contracting in Iraq and Afghanistan and a former senior Pentagon auditor, said that he was troubled by the fact that the state department had very little experience to oversee this civilian surge in Iraq:

"(I)t is not clear that it has the trained personnel to manage and oversee contract performance of a kind that has already shown the potential for creating tragic incidents and frayed relations with host countries."

Courtesy of WikiLeaks, we now know that many more deadly shootings have taken place by these unregulated private security contractors than we knew of before. Given this new knowledge, it is time that we demand an inquiry into the privatisation of the military. Right now, the prime facie evidence is that it has considerably increased the number of unnecessary violent incidents, while reducing military discipline and accountability and costing taxpayers a bundle.

• Editor's note: the incident detailed at the top of this article occurred in 2005, not 2004, as was originally stated; all other details are correct, and the article was amended at 12:00 on 24 October 2010.

• This article was further amended on 10 November 2010 to amend and clarify the description of what an "escalation of force" incident is.