How do prospective employers go about screening candidates' social networking profiles if they have high privacy settings and are not friends with the person? Do they have some "back door" access if they pay FB enough money to let them see everyone or some other privacy violation of that nature?
As an employer, I routinely search for names of candidates as part of the pre-screening process. In addition, if the candidate's resume mentions a blog, twitter account, linked in account, or public Facebook page, I check those. I don't use any "back door" methods (and doubt they exist) but I will do things like "hm, the blog domain is codebunny [I just made that up, don't go search it] I wonder if I will find anything searching for that in addition to or instead of the candidate's legal name?" and I will follow links from say your StackExchange profile to your Twitter profile to your website and so on.
I can learn both good and bad things from such a search:
I always keep in mind that there may be many people with the same name, and that the person I find in a search may not be the person who is applying to me. I have never voted "hire" or "no hire" simply because of something I found from a search. It has been fodder for interview questions though. And none of this is new - we used to search for what people were posting on usenet newsgroups, 20 years ago, for just the same reasons.
Quite frankly, to the best of my knowledge - they don't crack your settings and screen your profile. In fact, the variation of how employers view social media profiles is incredibly diverse these days - the whole phenomenon is too new to have a single right answer or common norm for all employers. I've seen everything from the very thoughtful (and in my mind, honorable) post that Kate Gregory offers, to a deliberate effort to avoid them entirely. I haven't, yet, seen an employer go out of their way to "crack" a profile. In most cases, I would expect that to be seen as unethical and something a reasonable company would avoid.
However, realize that nothing about you or your behavior online is really "private". I have several friends who do not even maintain social media profiles because of privacy reasons, and yet pictures of them, their legal names, and other activities are blogged, tweeted, commented on, or otherwise updated through their friend's social media activity. So it's not just your privacy settings that are the control over what an employer can and can't see.
A common guidance I've seen that makes sense to me is to focus on enhancing your online identity through positive, professional behavior - write good articles, ask thoughful questions, be professional in your communications and be honest. Try to avoid an online identity that features behavior you don't want to be accountable for - certainly we've all done a few silly things we are glad our employers haven't seen, but try to avoid building an online community for yourself that encourages and highlights this behavior.