Privacy advocates have objected to the spending bill’s quiet inclusion of the Cybersecurity Information Sharing Act, or CISA, a measure they say will expand mass surveillance under the guise of cybersecurity. Among other provisions are new restrictions on the Visa Waiver Program, which could force Europeans and others deemed to be nationals of Iran, Iraq, Syria or Sudan –- or people who have visited those countries since 2011 — to obtain a visa before entering the United States. Since the move is likely to trigger reciprocal restrictions from other countries, including in Europe, critics warn Iranian Americans could now be treated as “second-class citizens” when traveling abroad.