We obviously must have acted on intell. Sometimes terrorist organizations use false tips as a "trace element" to test their communications security. This may just have been a test of agent reliablity etc on the part of AQ. If the "tipped" ship is searched, they know they have a leak and plug it, or go to alternate comms for the "real" act of terrorism involving a ship.