How do prospective employers go about screening candidates' social networking profiles if they have high privacy settings and are not friends with the person? Do they have some "back door" access if they pay FB enough money to let them see everyone or some other privacy violation of that nature?
As an employer, I routinely search for names of candidates as part of the pre-screening process. In addition, if the candidate's resume mentions a blog, twitter account, linked in account, or public Facebook page, I check those. I don't use any "back door" methods (and doubt they exist) but I will do things like "hm, the blog domain is codebunny [I just made that up, don't go search it] I wonder if I will find anything searching for that in addition to or instead of the candidate's legal name?" and I will follow links from say your StackExchange profile to your Twitter profile to your website and so on.
I can learn both good and bad things from such a search:
- this candidate seems to know quite a lot about technologies we use
- this candidate has been publicly using technologies for as long as the resume says, or perhaps has used the phrase "I am just getting started with" far too recently to agree with the resume
- this candidate is a good writer, or a good speaker, and is generous with that technical knowledge
- this candidate is rude, or arrogant, or a showoff
- this candidate is connected to a number of people or communities that are important to us
- this candidate doesn't seem to know how or why to ensure private things are kept private
I always keep in mind that there may be many people with the same name, and that the person I find in a search may not be the person who is applying to me. I have never voted "hire" or "no hire" simply because of something I found from a search. It has been fodder for interview questions though. And none of this is new - we used to search for what people were posting on usenet newsgroups, 20 years ago, for just the same reasons.
Quite frankly, to the best of my knowledge - they don't crack your settings and screen your profile. In fact, the variation of how employers view social media profiles is incredibly diverse these days - the whole phenomenon is too new to have a single right answer or common norm for all employers. I've seen everything from the very thoughtful (and in my mind, honorable) post that Kate Gregory offers, to a deliberate effort to avoid them entirely. I haven't, yet, seen an employer go out of their way to "crack" a profile. In most cases, I would expect that to be seen as unethical and something a reasonable company would avoid.
However, realize that nothing about you or your behavior online is really "private". I have several friends who do not even maintain social media profiles because of privacy reasons, and yet pictures of them, their legal names, and other activities are blogged, tweeted, commented on, or otherwise updated through their friend's social media activity. So it's not just your privacy settings that are the control over what an employer can and can't see.
A common guidance I've seen that makes sense to me is to focus on enhancing your online identity through positive, professional behavior - write good articles, ask thoughful questions, be professional in your communications and be honest. Try to avoid an online identity that features behavior you don't want to be accountable for - certainly we've all done a few silly things we are glad our employers haven't seen, but try to avoid building an online community for yourself that encourages and highlights this behavior.
Just to the point of the "back door".
If you are applying for a job with an intelligence agency, or a any high security clearance, be assured that they have a back door. Even if they don't - you will never know. So, keep your profile clean.
Even without a backdoor, sites like FB, twitter, Instagram, etc, will gladly turn over data to a warrant or subpoena.
In general, if they check at all, HR people and hiring managers do what Beth said, and just do a quick search - LinkedIn, or some industry-specific stuff. FB is rarely looked at because of most profiles being 'friend' and 'friend of friend' only.
If any company asks for your password - plainly state that you cannot provide the password as that would violate the terms of service as well as the US CFAA (if you are in US). If they are testing you, you pass. If they really want it, then you don't want to work there. You might "like" candidate "A" when the company owner likes "B" and they fire you for that.