Create page which will send this file to user. eg/file_download.asp?filename=pic1.jpg, and check user permissions in thepage.