This can't possibly be true. Since Mozilla is encrypting the file, they can also decrypt it (and must do so when the recipient downloads it).
Edit: I was wrong, but will leave this comment because the explanation is useful.
The URL that is shared contains the key for the file. You'll notice that the URL contains a fragment identifier, i.e the #foo part of http://example.com/#foo, this isn't transmitted to the server by the browser and therefore the key isn't exposed beyond who the URL is shared to.
https:// send.firefox.com/download/<$file_identifier>/#<$encryption_key>
Data after the # in the url should not be sent to the http server by the client. Encryption/decryption is presumably handled in the users browser by JavaScript.
The statement about not having the ability to access the contents of the files is perhaps somewhat misleading as they do control the JavaScript that either creates the key or will be given access to the key when someone retrieves the file (by reading it off the end of the url).
Are there other ISP based systems, say, that perhaps sample the head of a file for anti-malware purposes that might do the same?
https://github.com/mozilla/send/blob/master/frontend/src/fil...