Private files can only be viewed by users logged-in to EthosCE.
The private file option, when enabled in a private course object, will restrict logged-in users from viewing the file unless they are enrolled in the course and that course object is available to them.
If the private file is not in a course object that is set to private, any logged in user may be able to see a private file.
Each time a private file is viewed, an access check is made to determine if the user is allowed to see that file.