Pick your data point:

The Interactive Advertising Bureau says U.S. spending on Web ads hit $5.9 billion in the first quarter of 2010. That’s a record for the first quarter of the year, but it’s a relatively modest 7.5 percent increase over a very crummy comparison in 2009.

And bear in mind that the IAB’s data include search spending, which means that the spike is in large part a reflection of Google’s (GOOG) health.

Want a bigger number? Try comScore, which says that the volume of display ads, i.e., the kind you might see on this page, shot up 15 percent in the last year. But while comScore (SCOR) says total spending on display ads hit $2.7 billion for the quarter and that the average CPM (cost per thousand impressions) hit $2.48, it isn’t reporting how those numbers compare to last year’s results.

ComScore spokesman Andrew Lipsman says his company isn’t putting out comparative numbers because it has changed its reporting methodology, so it doesn’t have apple-to-apples data. But he allowed that overall spending, and prices, have at least increased “modestly” in the last year.

So that’s not-bad news for display giants like Yahoo (YHOO) and AOL (AOL). And most definitely not for Facebook, which is now selling more ad impressions than any other Web publisher in the U.S.

The Web’s dominant traffic counter is in the midst of overhauling its traffic-counting system in response to years of complaints from publishers who insist that their traffic has been undercounted.

Turns out, the publishers were often right.

ComScore’s old data, for instance, say the Huffington Post attracted 9.95 million unique visitors in December. But its new numbers peg HuffPo’s December traffic at 20 million uniques.

The difference is that comScore’s (SCOR) old system tracked small panels of users and extrapolated their traffic patterns across the Web. But its new “hybrid” system uses panel data along with records generated by actual visits to the site, counted via tracking cookies. Publishers that cooperate with comScore (SCOR) agree to let the company “tag” every Web page on their sites.

“This is a much much better, much more methodologically rigorous way of doing this,” says Linda Abraham, comScore’s chief marketing officer.

ComScore has been rolling out the new system for months and says it can now use it to report on 25 percent of the 50 biggest sites on the Web. Another 50 percent of the top sites have agreed to work with the system, Abraham says.

ComScore lets publishers who are already clients participate in the program for free. But it will charge everyone else $10,000 a year, which the company says helps cover the cost of new servers and other equipment it needs to process the new deluge of data.

UPDATE: Some more detail on comScore’s fees, which generated a Web flare-up after this piece ran. Abraham notes that comScore’s set-up fee is $5,000, which she says covers implementation costs and gives publishers access to its data for six months; comScore charges publishers who want to keep receiving reports an additional $5,000 for each subsequent six-month period. However, Abraham notes, “If you choose not to purchase report access, you are free to do that, and we’ll continue to report you as hybrid, free of charge, as long as you continue to beacon correctly.” For more from Abraham, see her response to Mahalo CEO Jason Calacanis’s criticism; here’s the company’s blog post on the subject.

The new system doesn’t necessarily generate a traffic boost. AOL’s (AOL) Living channel saw its numbers decline by two percent in the new system, for instance, and its radio site saw traffic drop by 20 percent. AOL’s overall traffic, though, is up nine percent by comScore’s count.

Hybrid measurement is particularly kind to small Web sites and those that generate a lot of traffic from users who visit while at work. Both categories have always been difficult for comScore to measure using panels.

TheStreet.com (TSCM), for instance, has watched its traffic shoot up 86 percent under the new system, to 3.3 million uniques. That’s still much less than the site itself reports–in its last quarterly filing, the financial network reported an audience of 8.1 million uniques.

The fact that comScore is tracking some Web sites using the new system and the rest of them with the old one will make things a bit sticky for some time. The company has stopped releasing its monthly Top 50 list until May, when it says it will have moved almost all participating sites into the hybrid system.

But some sites won’t end up working with comScore at all, which means that comScore will measure them with its old panel methodology. At some point, the company will be presenting apples-to-oranges numbers when it compares different sites.

Does any of this really matter? Yes and no.

Ad buyers do pay attention to comScore rankings when figuring out where to place their money, even as Web publishers have presented their own, higher numbers from their own server logs. For some sites, the new data will make their pitches more compelling.

On the other hand, this does nothing to solve the real problem facing most publishers: They can’t sell ads against all of their inventory, no matter who’s counting it. And a measurement system won’t ever be able to help with that one.

But first the company needs to figure out who the culprits are.

Microsoft (MSFT) has filed five so-called “John Doe” civil suits against the hackers, whom it can’t identify yet. Redmond accuses the unknown attackers of a variety of crimes, from fraud to copyright infringement; it says it hopes the filings will “deter malvertising in the future.” (See full text of the complaint below.)

There’s a decent chance that the Microsoft bad guys are, in fact, the same guys who hijacked the Times last weekend. The methodology they used to get the ads onto Redmond’s MSN publishing network seems similar, and so does the fake “virus detected” warning the ads use to confuse surfers.

And, intriguingly, online ad monitor Click Forensics says it thinks it has identified a link between the malware that the Times served up and the stuff that the Microsoft attackers were trying to distribute. The company also thinks the two attacks are connected to a click fraud ring it has dubbed the “Bahama Botnet.”

Even if Microsoft does end up getting its hands on these guys, I think we’ll be seeing more of this stuff. Since the Times story broke last weekend, I’ve been talking to a variety of ad tech experts about the incident. And it sounds as if the technique the hackers used to compromise the paper–essentially, passing themselves off as legitimate advertisers–will be very difficult to stop if someone is determined to use it.

The best solution I’ve heard so far: Monitoring systems that can quickly detect an attack and warn publishers that they’re running malvertisements. It’s unclear how long the bogus Times ad stayed up, but the fact that it got switched on over the weekend indicates that the attackers assumed the paper would be slow to react.

Microsoft Malware complaint –

That’s the conclusion Citigroup’s (C) Mark Mahaney reached after taking Microsoft’s (MSFT) new search engine for a spin and comparing it to Google’s (GOOG) and Yahoo’s (YHOO). The result: Google still delivers better results most of the time. In 71 percent of searches, Google either supplied the most relevant answer or tied with other engines. Bing did that 46 percent of the time.

But it’s worth checking out the results of Mahaney’s test to see exactly how the search engines stack up. For one thing, as he notes, Bing’s results are getting better as it matures–it’s only been live for about a month–and as it adds bells and whistles (for instance, it is catering to vanities of certain bloggers by including their Twitter stream in search results).

And Bing also performs better for at least two kinds of searches: Health and travel. So if you need to book a trip, or if you pick up a rash on that trip, you might want to think about Binging before you Google.

First, Mahaney’s methodology:

Over the past two weeks, we conducted 200 queries across the three major Search engines–Google, Yahoo! and Bing. Most of the queries we picked came from Google Zeitgeist, Microsoft’s xRank and Yahoo! Buzz, along with some personal queries. These queries spanned multiple categories, including Entertainment, Health, Local, News, Retail, Sports, Travel and Other. After conducting the same query across all three Search sites, we picked a winner based on: 1) relevancy of the organic search results; and 2) robustness of the search experience, which included factors such as image and video inclusion, Search Assist, and Site Breakout.

And his results. Overall relevancy (click to enlarge):

Relevancy by topic (click to enlarge):

But a common criticism of Nielsen’s study–which I also raised–was that Nielsen was only measuring visits to Twitter.com and not Twitter use via third-party apps. Theoretically, it’s possible to be an avid Twitter user without ever visiting the service’s Web site more than once.

Point taken, says Nielsen, which says it reran its study to account for that. And… no change! From Nielsen’s blog:

“As an update, we went beyond just Twitter.com, adding in more than 30 websites and applications that feed into the Twitter community including: TweetDeck, TwitPic, Twitstat, Hootsuite, EasyTweets, Tumblr, and many others. The results verified our initial findings: about 60 percent of people on Twitter end up abandoning the service after a month.”

If you’re so inclined, you can argue that Nielsen is still missing a big swath of Twitter users because it seems to have ignored mobile apps, which is where a lot of Twittering occurs.

But I still think Nielsen’s numbers sound about right, both in methodology and conclusion. I think it’s entirely possible that the majority of people who try Twitter don’t end up sticking with it, and I think that people who do use Twitter on third-party apps still end up at the site once a month. I do.

In a 352-page report published last week, the National Research Council said data mining and behavior detection aren’t nearly as useful as their proponents claim. In fact, they’re of dubious scientific merit and have “enormous potential” for infringing on law-abiding Americans’ privacy. “Automated identification of terrorists through data mining (or any other  known methodology) is neither feasible as an objective nor desirable as a goal of technology development efforts,” the Council found. “Even in well-managed programs, such tools are likely to return significant rates of false positives, especially if the tools are highly automated.”

While not an explicit condemnation of the techniques at issue here, the report does recommend that the government evaluate the effectiveness and lawfulness of these data mining and behavior-detection programs it’s so keen on before implementing them, and periodically thereafter. Said the Council, “History demonstrates that measures taken in the name of improving national security, especially in response to new threats or crises, have often proven to be both ineffective and offensive to the nation’s values and traditions of liberty and justice.”