The U.S. Coast Guard is very concerned about port security in the United States. Some vulnerabilities are widely known. For example, in  Puerto Rico, the main port of the island, San Juan, could easily be blocked if someone set off a large bomb in a ship while the vessel was in the main shipping channel. This would close the port, which is the main entry point for food that millions of island residents depend on. Two other well known vulnerabilities are the Houston ship channel and one of the tight turns in the Mississippi river below New Orleans. Block these two choke points with a large, sunk, ship and you stop nearly half our exports and oil imports. 

The scale of the vulnerability problem is huge. A large bomb in a ship, especially one carrying certain cargoes (oil, gasoline, Etc.), could have catastrophic effects. Liquefied natural gas (LNG), often portrayed as "the most dangerous" ship cargo, really isn't. Not explosive in it's liquid form, even if the container were breached, so that the LNG began to gasify again, the gas is lighter than air, and would disperse rapidly, unless confined. Even if not confined, the resulting gas would burn so quickly that explosive quantities would be unlikly to accumulate. But enough of this boring good news.

The United States has 55 major ports, many of which serve both military and civilian shipping. Those ports see over 7,500 foreign ships making over 50,000 visits a year. Much of what the Coast Guard talks about openly concerns having people, ships and boats available if a terrorist ship does come calling. What is not discussed openly, at least not much, is how the terrorist ship will be found among the thousands coming and going within American ports each day. Some of the work is out of the Coast Guards hands, especially much of the intelligence. The Coast Guard depends on the CIA, FBI and other agencies to spot potential terrorist boats a long way off. Up close, the Coast Guard uses profiling. If something looks amiss (and exactly what constitutes amiss is kept secret), then that ship is stopped and boarded, as far away from an American post as possible. 

So far, the only reporting about al Qaeda attempts at an attack using merchant ships, has been speculation and rumor. Captured documents in Afghanistan indicate that al Qaeda was talking about this sort of thing. But since losing their base, the use of ships has apparently fallen down, if not off, the priority lost. But the potential is there, as is the vulnerability.