It sounds more like it's a practical sysadmin stuck in an impractical pointyhead-caused hell. 1. Youtube needs to work 2. It's not considered sensitive by the

It sounds more like it's a practical sysadmin stuck in an impractical pointyhead-caused hell. 1. Youtube needs to work 2. It's not considered sensitive by the business (and I hope to god nobody uses Google credentials) 3. He can't change PCI-relevant settings or he'll get fired (and the business could potentially lose some sort of financial accreditation, or endanger a business partnership) 4. He can circumvent the requirements by disabling SSL for Youtube, which seems to be a loophole in PCI's laughable "security" requirements. Sucks, but it happens. I'm sure he's polishing up his resumé.