Seems pretty clear that they could decrypt the traffic they were interested in, they also talk about 5 years of retention of all traffic that they can decrypt at anytime. Sound familiar?
Looks like they used a squid feature: https://wiki.squid-cache.org/Features/SslBump