I need some help understanding private contractors (KBR, Blackwater, etc) vs. the law

I'm in a FB discussion about KBR and Jamie Leigh Jones and I'm trying to explain the legal immunity of private contractors in Iraq. Please tell me if I've got these straight:

Paul Bremer's Coalition Provisional Authority Order 17 gave contractors immunity under Iraqi law.

The UCMJ didn't apply to private contractors because they were civilians. (Can someone help clarify this? I'm having trouble grasping whether or not the UCMJ applied to KBR or not and why. I also read about the Military Extraterritorial Jurisdiction Act, and how that didn't cover Blackwater because they were employed by the State Department instead of the Department of Defense, but I don't know if that applied to KBR as well?)

In 2007, legislation to make private contractors subject to US law passed in the House. I'm not sure what happened after that.

Basically, in 2005 when Jones's case happened, KBR didn't fall under US law because they were in another country, didn't fall under the USMJ as government or military employees for some reason I don't really grasp yet, and didn't fall under Iraqi law because of CPA Order 17.

If anybody can help me clear up my understanding on this, I'd be grateful. Thanks!